This is not the problem about return type. The html you saw is what Spring return as default (without needing any config). This tell you that you didn't login so that first of all login with the html login page first. In case if you want to turn this login off, you .permitAll