diff --git a/src/main/java/io/codeka/gaia/config/SecurityConfig.java b/src/main/java/io/codeka/gaia/config/SecurityConfig.java
index eaee4f66a..ec2fd5afc 100644
--- a/src/main/java/io/codeka/gaia/config/SecurityConfig.java
+++ b/src/main/java/io/codeka/gaia/config/SecurityConfig.java
@@ -37,6 +37,8 @@ protected void configure(HttpSecurity http) throws Exception {
                 .csrf().disable()
                 .authorizeRequests()
                     .antMatchers("/api/**").permitAll()
+                    .antMatchers("/webjars/**").permitAll()
+                    .antMatchers("/css/**", "/js/**", "/favicon.ico", "/images/**").permitAll()
                     .antMatchers("/**").authenticated()
                 .and()
                 .formLogin().permitAll()