<security:authentication var="user" property="principal" />
    <c:if test="${empty user}">

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableAspectJAutoProxy(proxyTargetClass = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {


@Override
    protected void configure(HttpSecurity http) throws Exception {

        http
                .authorizeRequests()
                .antMatchers("/").permitAll()


....

}


    @Override
    public void configure(WebSecurity web) throws Exception {
        web
                .ignoring()
                .antMatchers("/")
                .antMatchers("/media/**/*.{js,html,css}")
                .antMatchers("/favicon.ico", "/about");
    }

@Configuration
@EnableWebMvc
public class WebConfig extends WebMvcConfigurerAdapter {


    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/").setViewName("index");
    }

<%@page contentType="text/html" pageEncoding="UTF-8"%>
<%@page trimDirectiveWhitespaces="true"%>
<%@page language="java"%>
<%@page session="true" %>
<%@taglib prefix="t" tagdir="/WEB-INF/tags" %>
<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<%@taglib prefix="security" uri="http://www.springframework.org/security/tags"%>
<t:default>
    <h1>TEST</h1>
    <security:authentication var="user" property="principal" />
    <c:if test="${empty user}">
        <h1><a href="/login"> Для продолжения авторизуйтесь. </a></h1>
    </c:if>
</t:default>

        <security:authorize access="isAuthenticated()">
            Вы авторизованы 
        </security:authorize>

    @Override
    public void configure(WebSecurity web) throws Exception {
        web
                .ignoring()
               // .antMatchers("/")
                .antMatchers("/media/**/*.{js,html,css}")
                .antMatchers("/favicon.ico", "/about");
    }

<security:authentication var="user" property="principal" />
    <c:if test="${empty user}">

    <security:authorize access="!isAuthenticated()">
            <h1><a href="/login"> Для продолжения авторизуйтесь. </a></h1>
    </security:authorize>