Spring MVC указать правильный путь в контроллере

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
    private final UserDetailsService userDetailsService;
 
    @Autowired
    public SecurityConfig(@Qualifier("userDetailsServiceImpl") UserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }
 
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/").permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .loginPage("/auth/login").permitAll()
                .defaultSuccessUrl("/auth/success")
                .and()
                .logout()
                .logoutRequestMatcher(new AntPathRequestMatcher("/auth/logout", "POST"))
                .invalidateHttpSession(true)
                .clearAuthentication(true)
                .deleteCookies("JSESSIONID")
                .logoutSuccessUrl("/auth/login");
    }
 
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(daoAuthenticationProvider());
    }
 
    @Bean
    protected PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }
 
    @Bean
    protected DaoAuthenticationProvider daoAuthenticationProvider() {
        DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
        daoAuthenticationProvider.setPasswordEncoder(passwordEncoder());
        daoAuthenticationProvider.setUserDetailsService(userDetailsService);
        return daoAuthenticationProvider;
    }
}

@Configuration
@EnableTransactionManagement
@ComponentScan(basePackages = {"com.example.springcourse"})
//@EnableJpaRepositories(basePackages = "com.example.springcourse"/*, entityManagerFactoryRef = "dataSourse"*/)
@EnableWebMvc
//@PropertySource(
//        factory = YamlPropertySourceFactory.class,
//        value = {"classpath:test.yaml"})
public class SpringConfig implements WebMvcConfigurer {
 
    private final ApplicationContext applicationContext;
 
    @Resource
    private Environment env;
 
    @Autowired
    public SpringConfig(ApplicationContext applicationContext) {
        this.applicationContext = applicationContext;
    }
 
    @Bean
    public SpringResourceTemplateResolver templateResolver() {
        SpringResourceTemplateResolver templateResolver = new SpringResourceTemplateResolver();
        templateResolver.setApplicationContext(applicationContext);
        templateResolver.setPrefix("/WEB-INF/views/");
        templateResolver.setSuffix(".html");
        return templateResolver;
    }
 
    @Bean
    public SpringTemplateEngine templateEngine() {
        SpringTemplateEngine templateEngine = new SpringTemplateEngine();
        templateEngine.setTemplateResolver(templateResolver());
        templateEngine.setEnableSpringELCompiler(true);
        return templateEngine;
    }
 
    @Override
    public void configureViewResolvers(ViewResolverRegistry registry) {
        ThymeleafViewResolver resolver = new ThymeleafViewResolver();
        resolver.setTemplateEngine(templateEngine());
        registry.viewResolver(resolver);
    }
 
    @Bean
    public DataSource dataSource() {
        DriverManagerDataSource dataSource = new DriverManagerDataSource();
        dataSource.setDriverClassName("org.postgresql.Driver");
        dataSource.setUrl(String.format("jdbc:postgresql://%s:%s/%s",
                env.getRequiredProperty("postgresql.dataSource.serverName"),
                env.getRequiredProperty("postgresql.dataSource.portNumber"),
                env.getRequiredProperty("postgresql.dataSource.databaseName")));
        dataSource.setUsername(env.getRequiredProperty("postgresql.dataSource.user"));
        dataSource.setPassword(env.getRequiredProperty("postgresql.dataSource.password"));
        return dataSource;
    }
}

public class SpringMvcDispatcherServletInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
    @Override
    protected Class<?>[] getRootConfigClasses() {
        return null;
    }
 
    @Override
    protected Class<?>[] getServletConfigClasses() {
        return new Class[]{SpringConfig.class};
    }
 
    @Override
    protected String[] getServletMappings() {
        return new String[]{"/"};
    }
 
    @Override
    public void onStartup(ServletContext aServletContext) throws ServletException {
        super.onStartup(aServletContext);
        registerHiddenFieldFilter(aServletContext);
    }
 
    private void registerHiddenFieldFilter(ServletContext aContext) {
        aContext.addFilter("hiddenHttpMethodFilter",
                new HiddenHttpMethodFilter()).addMappingForUrlPatterns(null, true, "/*");
    }
}

@Controller
@RequestMapping("/auth")
public class AuthController {
    @Autowired
    public SuccessService successService;
    final ProductRepository repository;
 
    public AuthController(ProductRepository repository) {
        this.repository = repository;
    }
 
    @GetMapping("/login")
    public String getLoginPage() {
        return "login";
    }
 
    @GetMapping("/success")
    public String getSuccessPage(@ModelAttribute Product product, Model model) {
        model.addAttribute("success", product);
        model.addAttribute("index", successService.index());
        return "success";
    }
 
    @DeleteMapping("/{id}")
    public String delete(@PathVariable("id") Long id) {
        successService.delete(id);
        return "redirect:/success";
    }
 
    @GetMapping("/{id}")
    public String show(@PathVariable("id") Long id, Model model) {
        model.addAttribute("product", successService.show(id));
        return "show";
    }
 
    @PatchMapping("/{id}")
    public String update(@ModelAttribute("product") Product product, @PathVariable("id") Long id) {
        successService.update(id, product);
        return "redirect:/success";
    }
 
    @GetMapping("/new")
    public String newPerson(@ModelAttribute("product") Product product) {
        return "product/new";
    }
 
    @PostMapping()
    public String create(@ModelAttribute("product") Product product) {
        successService.save(product);
        return "redirect:/success";
    }
}