Spring Boot, JS. It doesn't work on the input password. But it starts working if the user authorised.

[emerson]

function show_hide_password(target){
    var input = document.getElementById('password-input');
    if (input.getAttribute('type') === 'password') {
        target.classList.add('view');
        input.setAttribute('type', 'text');
    } else {
        target.classList.remove('view');
        input.setAttribute('type', 'password');
    }
    return false;
}

.input {
    width: 300px;
    margin: 15px auto;
    position: relative;
}
#password-input, #username-input {
    width: 100%;
    padding: 5px 0;
    height: 30px;
    line-height: 40px;
    text-indent: 10px;
    margin: 0 0 15px 0;
    border-radius: 5px;
    border: 1px solid #999;
    font-size: 18px;
}
.password-control {
    position: absolute;
    top: 11px;
    right: 6px;
    display: inline-block;
    width: 20px;
    height: 20px;
    background: url(https://snipp.ru/demo/495/view.svg) 0 0 no-repeat;
}
.password-control.view {
    background: url(https://snipp.ru/demo/495/no-view.svg) 0 0 no-repeat;
}

<section  class="authorization">
    <form th:action="@{/}" th:authentication-success-handler-ref="authSuccessHandler" method="post">
        <div>
            <div class="input">
                <input type="text" id="username-input" name="username" placeholder="Логин">
            </div>
            <div class="input">
                <input type="password" id="password-input" placeholder="Пароль" name="password">
                <a href="#" class="password-control" onclick="return show_hide_password(this);"></a>
            </div>
        </div>
            <div class="btn">
                <input type="submit" id="asubmit" class="buttonAuth" value="Авторизоваться" >
            </div>
    </form>
</section>

At the beginning of the application, the input password shall not be shown. But it starts working after the copying. I've authorised, I've returned to the page and the Glasik works, it's showing me and hiding the password.
Again, if I'm different, the password's turning back to work, why? What can we do about it?

[meriah]

The problem was solved as follows: added the name of the director "/js/**."

/* Разрешаем Spring Security допускать следующие директории */
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/css/**","/js/**");
    }

And when the glazing application starts, it works: