diff --git a/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml b/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml
index 1ba55d9ecd..263654ff29 100644
--- a/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml
+++ b/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml
@@ -15,6 +15,7 @@
 
     <global-method-security pre-post-annotations="enabled" />
 
+    <http pattern="/static/**" security="none"/>
     <http pattern="/loggedout.jsp" security="none"/>
 
     <http use-expressions="true">