Introduction

A blank H2 console screen after login in Spring Boot usually points to security headers, path configuration mismatch, or browser-side blocking. The login form can still appear, which makes the issue confusing because connection settings look correct. A structured check of security config, console path, and JDBC URL resolves most cases quickly.

Typical Root Causes

Most blank-screen reports come from one of these:

• X-Frame-Options or content security settings blocking H2 UI frames
• Spring Security rules denying parts of /h2-console resources
• Wrong JDBC URL for in-memory database lifecycle
• Context path or reverse proxy rewriting that breaks console asset loading

Open browser developer tools and check network and console errors first. Missing script files or frame-blocked responses usually reveal the real cause.

Minimum Spring Boot Properties

Start with explicit console settings in application.properties:

1spring.h2.console.enabled=true
2spring.h2.console.path=/h2-console
3spring.datasource.url=jdbc:h2:mem:testdb
4spring.datasource.driver-class-name=org.h2.Driver
5spring.datasource.username=sa
6spring.datasource.password=

If you use file-based DB instead of in-memory, switch URL accordingly.

Spring Security Configuration for H2 Console

With Spring Security enabled, allow console endpoints and relax frame rules for local development.

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.config.Customizer;
4import org.springframework.security.config.annotation.web.builders.HttpSecurity;
5import org.springframework.security.web.SecurityFilterChain;
6
7@Configuration
8public class SecurityConfig {
9    @Bean
10    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
11        http
12            .authorizeHttpRequests(auth -> auth
13                .requestMatchers("/h2-console/**").permitAll()
14                .anyRequest().authenticated()
15            )
16            .csrf(csrf -> csrf
17                .ignoringRequestMatchers("/h2-console/**")
18            )
19            .headers(headers -> headers
20                .frameOptions(frame -> frame.sameOrigin())
21            )
22            .httpBasic(Customizer.withDefaults());
23
24        return http.build();
25    }
26}

If frame options are not set to same origin, H2 pages may render blank due to blocked frame loading.

In-Memory Database Lifecycle Confusion

In-memory H2 databases vanish when last connection closes unless configured otherwise. If the console connects to a different URL or timing changes, you may see empty state or misleading behavior.

For stable dev sessions, consider:

spring.datasource.url=jdbc:h2:mem:testdb;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE

Use the same URL in application and H2 console login form.

Context Path and Reverse Proxy Checks

If your app uses server.servlet.context-path, the console endpoint changes. For example, with /app context path, console is under /app/h2-console. A mismatch can load form HTML but fail JS and CSS resources.

If behind Nginx or another proxy, confirm forwarding rules do not strip required console paths.

Fast Debug Workflow

Use this sequence:

1. Open browser dev tools and inspect failed requests after login.
2. Confirm spring.h2.console.path and actual URL match.
3. Verify security rules permit /h2-console/** and frame same origin.
4. Compare JDBC URL in app properties and login form.
5. Test with a clean browser profile to rule out extensions and cache.

This workflow usually isolates the issue in minutes.

Production Safety Note

H2 console should be disabled outside local development. Keep it behind strict profiles and never expose it publicly.

spring.h2.console.enabled=false

For production diagnostics, use controlled database tooling and audited access channels.

Common Pitfalls

• Enabling console but forgetting security exceptions for its assets
• Allowing endpoint path but leaving frame policy too strict
• Using a different JDBC URL in form than the application datasource
• Ignoring context-path effects and testing wrong console URL
• Leaving H2 console enabled in shared or production environments

Most blank-screen cases are configuration alignment issues, not H2 bugs.

Summary

• Blank H2 console pages are usually caused by security or path misconfiguration.
• Permit /h2-console/**, ignore CSRF for it, and set frame same origin.
• Keep JDBC URL consistent between app config and console login.
• Validate context path and proxy behavior when assets fail to load.
• Disable H2 console outside development environments.