<h:form id="formLogin" prependId="false">
  <center>
    <p:messages closable="true"/>

    <p:panelGrid columns="2">
    <f:facet name="header">Login</f:facet>

    <h:outputLabel for="username" value="Username:" />
    <p:inputText id="username" required="true" />

    <h:outputLabel for="password" value="Password:" />
    <p:password id="password" required="true" feedback="false" />

    <f:facet name="footer">
      <center>
        <p:commandButton value="Login" ajax="false" action="#{loginController.doLogin('login')}"/>
      </center>
     </f:facet>

   </p:panelGrid>
 </center>
</h:form>

public String doLogin(String path) throws ServletException, IOException
{
    ExternalContext context = FacesContext.getCurrentInstance().getExternalContext();

    ServletRequest servletRequest = (ServletRequest)context.getRequest();
    RequestDispatcher dispatcher = servletRequest.getServletContext().getRequestDispatcher(path.startsWith("/") ? path : "/" + path);
    dispatcher.forward(servletRequest, (ServletResponse)context.getResponse());

    FacesContext.getCurrentInstance().responseComplete();

    return null;
}

<http pattern="/resources/css/**" security="none"/>
<http pattern="/resources/images/**" security="none"/>
<http pattern="/javax.faces.resource/**" security="none"/>

<http>
  <intercept-url pattern="/views/login.xhtml" access="isAnonymous()"/>
  <intercept-url pattern="/" access="hasRole('USER')"/>
  <intercept-url pattern="/**" access="hasRole('USER')"/>
  <form-login
    login-page="/views/login.xhtml"
    login-processing-url="/login"
    always-use-default-target="true"
    default-target-url="/views/persones.xhtml"/>
  <http-basic/>
  <csrf disabled="true"/>
  <logout invalidate-session="true"
    delete-cookies="JSESSIONID,SPRING_SECURITY_REMEMBER_ME_COOKIE"
    logout-success-url="/views/login.xhtml">
  </logout>
</http>

@Configuration
public class WebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter
{
    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
      http
        .authorizeRequests()
          .antMatchers("/resources/css/**, /resources/images/**").permitAll()
          .antMatchers("/javax.faces.resource/**").permitAll()
          .antMatchers("/views/login*").permitAll()
          .antMatchers("/views/error.xhtml").permitAll()
          .anyRequest().authenticated()
        .and()
          .formLogin()
          .loginPage("/views/login.xhtml")
          .loginProcessingUrl("/login")
          .defaultSuccessUrl("/views/persones.xhtml", true)
        .and()
          .httpBasic()
        .and()
          .logout().logoutSuccessUrl("/views/login.xhtml")
          .invalidateHttpSession(true)
          .deleteCookies("JSESSIONID", "SPRING_SECURITY_REMEMBER_ME_COOKIE")
        .and()
          .csrf().disable();
    }
}