Spring security http-form redirect to 404 page

Question

I need to add spring security to my webapp. My application uses spring an also vaadin for the admin part. I'm using form-login as auth mode. So the problem I'm struggling with is that when I try to post the following form:

<form name='f' action="j_spring_security_check"
    method='POST'>

    <table>
        <tr>
            <td>User:</td>
            <td><input type='text' name='j_username' value=''>
            </td>
        </tr>
        <tr>
            <td>Password:</td>
            <td><input type='password' name='j_password' />
            </td>
        </tr>
        <tr>
            <td colspan='2'><input name="submit" type="submit"
                value="submit" />
            </td>
        </tr>
        <tr>
            <td colspan='2'><input name="reset" type="reset" />
            </td>
        </tr>
    </table>

</form>

I get a 404 redirect. So here I paste my web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

    <!-- The definition of the Root Spring Container shared by all Servlets and Filters -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring/root-context.xml</param-value>
    </context-param>

    <context-param>
        <description>Vaadin production mode</description>
        <param-name>productionMode</param-name>
        <param-value>false</param-value>
    </context-param>

    <!-- Enables Spring Security -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>
            org.springframework.web.filter.DelegatingFilterProxy
        </filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- Enables Spring internationalization -->
    <filter>
        <filter-name>encoding-filter</filter-name>
        <filter-class>
            org.springframework.web.filter.CharacterEncodingFilter
        </filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
    </filter>

    <filter-mapping>
        <filter-name>encoding-filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- Creates the Spring Container shared by all Servlets and Filters -->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <!-- Processes application requests -->
    <servlet>
        <servlet-name>appServlet</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>/WEB-INF/spring/appServlet/servlet-context.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet>
        <servlet-name>Vaadin Application Servlet</servlet-name>
        <servlet-class>com.vaadin.terminal.gwt.server.ApplicationServlet</servlet-class>
        <init-param>
            <description>Vaadin application class to start</description>
            <param-name>application</param-name>
            <param-value>com.windy.server.admin.MyVaadinApplication</param-value>
        </init-param>
    </servlet>

    <servlet-mapping>
        <servlet-name>Vaadin Application Servlet</servlet-name>
        <url-pattern>/admin/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>Vaadin Application Servlet</servlet-name>
         <url-pattern>/VAADIN/*</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>appServlet</servlet-name>
        <url-pattern>*.do</url-pattern>
    </servlet-mapping>



    <error-page>
        <error-code>404</error-code>
        <location>/WEB-INF/views/page404.jsp</location>
    </error-page> 

</web-app>

and here my spring security configuration:

<security:http authentication-manager-ref="authenticatioManager" auto-config="true" pattern="/web/**">
    <security:intercept-url pattern="/web/**" access="ROLE_AUTH" />
    <security:form-login login-page="/loginTest.do" default-target-url="/loginWelcome.do"
        authentication-failure-url="/loginfailed.do" />
    <security:logout logout-success-url="/logout.do" invalidate-session="true"/> 
    <security:session-management>
        <security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" expired-url="/web/login" />
    </security:session-management>
</security:http>

<bean id="userDetailsService" class="com.ddelizia.server.service.core.impl.UserDetailsServiceImpl"/>

<security:authentication-manager id="authenticatioManager">
  <security:authentication-provider user-service-ref="userDetailsService">
    <!-- <security:password-encoder hash="md5"/> -->
  </security:authentication-provider> 
</security:authentication-manager>

I also tried to add to the form login the parameter login-processing-url="/login_spring" and changed in the form action to login_spring

my application is running on tomcat at the address localhost:8080/myapp and the login action is called on localhost:8080/myapp/login_spring but Still i get the same error.

I also tried to modify my web.xml changing the spring security filter mapping as following:

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>*.log</url-pattern>
    </filter-mapping>

and changing the login-processing-url="/login_spring.log" but still I get the 404 page.

Then I tried to switch to a http-basic authentcation but in this case it works... I don't understand what I'm doing wrong...

Thanks in advance for your help

Answer 1

Change your form element to:

<form name='f' action='<c:url value="/j_spring_security_check" />' method='POST'>

Also add JSTL Core taglib at the beginning of file if you don't have it:

<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>

EDIT:

I think I spotted source of problem. Remove pattern="/web/**" from <http> element leaving only <security:http authentication-manager-ref="authenticatioManager" auto-config="true">.

What's more, j_spring_security_check must be in springSecurityFilterChain, so change mapping to:

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

and try now without login-processing-url in <form-login> but with <c:url>. We have similar config in our Vaadin app and it works just fine.