Spring-security :The page isn't redirecting properly

Question

i want to use spring security from spring in m web application so here's the configuration:

This is the spring-security.xml :

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<http auto-config="true" use-expressions="false">
    <intercept-url pattern="/**" access="ROLE_USER" />
    <form-login login-page="/authentication"  login-processing-url="/static  
              /j_spring_security_check" authentication-failure 
              url="/login?login_error=t" />

</http>

<authentication-manager>
  <authentication-provider>
     <jdbc-user-service id="userService"
       data-source-ref="DataSource"
       users-by-username-query="select name, password, true from person where name=?"
       authorities-by-username-query="select name,'ROLE_USER' from person where    
       name=?" />
  </authentication-provider>
</authentication-manager>

Web.xml :

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xmlns="http://java.sun.com/xml/ns/javaee"
 xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
 xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns  
 /javaee/web-app_2_5.xsd"
 id="WebApp_ID" version="2.5">

  <display-name>OTV_JSF_PrimeFaces_Spring_Hibernate</display-name>

  <!-- Spring Context Configuration' s Path definition -->
  <context-param>
  <param-name>contextConfigLocation</param-name>
  <param-value>
  /WEB-INF/applicationContext.xml
  /WEB-INF/spring-security.xml
  </param-value>
 </context-param>

 <!-- The Bootstrap listener to start up and shut down Spring's root  
   WebApplicationContext. It is registered to Servlet Container -->
 <listener>
  <listener-class>
    org.springframework.web.context.ContextLoaderListener
  </listener-class>
 </listener>
 <listener>
 <listener-class>
     org.springframework.web.context.request.RequestContextListener
 </listener-class>
 </listener>

<!-- Project Stage Level -->
 <context-param>
  <param-name>javax.faces.PROJECT_STAGE</param-name>
  <param-value>Development</param-value>
 </context-param>

<!-- Welcome Page -->
<welcome-file-list>
  <welcome-file>/home.xhtml</welcome-file>
</welcome-file-list>

<!-- JSF Servlet is defined to container -->
 <servlet>
 <servlet-name>Faces Servlet</servlet-name>
 <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
 <load-on-startup>1</load-on-startup>
</servlet>

<!-- Mapping with servlet and url for the http requests. -->
<servlet-mapping>
 <servlet-name>Faces Servlet</servlet-name>
 <url-pattern>*.jsf</url-pattern>
 </servlet-mapping>
 <servlet-mapping>
   <servlet-name>Faces Servlet</servlet-name>
   <url-pattern>*.faces</url-pattern>
 </servlet-mapping>
<servlet-mapping>
 <servlet-name>Faces Servlet</servlet-name>
 <url-pattern>*.xhtml</url-pattern>
</servlet-mapping>

   <!-- Spring Security -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>  org.springframework.web.filter.DelegatingFilterProxy   
            </filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>

here's the application :

When i run the application , this URL is opened http://localhost:8089/MVNOONPProject/authentication and i get this error :

 `The page isn't redirecting properly
  Firefox has detected that the server is redirecting the request for this address in 
  a way that will never complete.`

I'm sure it's a problem with the web.xml . But i didn't find how to solve it .

Thank you in advance

Answer 1

Since the pattern="/**" intercepts all URL requests including login page itself, any user has to be logged in even to access the login page.. so after hours of trying, following did the trick for me..

<intercept-url pattern="/login**" access="ROLE_ANONYMOUS" />
<intercept-url pattern="/resources/**" access="ROLE_ANONYMOUS, ROLE_USER, ROLE_ADMIN" />
<intercept-url pattern="/**" access="ROLE_USER" />

<form-login 
    login-page="/login" 
    default-target-url="/home"
    authentication-failure-url="/login?error=true" />

Notice,

• the order of intercept-url tags
• pattern="/**" basically intercepts all url request, even resources like css and image file. that's why the second line is needed.

Other answers were quite close but weren't working with Spring MVC 3.2.3.RELEASE version

I think this might cause other problems in the future, so the better approach might be,

<intercept-url pattern="/admin*" access="ROLE_ADMIN" />
<intercept-url pattern="/user*" access="ROLE_USER, ROLE_ADMIN" />
<form-login 
    login-page="/login" 
    default-target-url="/home"
    authentication-failure-url="/login?error=true" />

Answer 2

Thats because , you spring security configuration redirects cyclically.

try this ,

<http auto-config="true" use-expressions="false">
     <intercept-url pattern="/login.jsp*" filters="none"/>
    <intercept-url pattern="/**" access="ROLE_USER" />
    <form-login login-page="/authentication"  login-processing-url="/static  
              /j_spring_security_check" authentication-failure 
              url="/login?login_error=t" />

</http>

Edit

---

<http auto-config="true" use-expressions="false">
     <intercept-url pattern="/authentication" filters="none"/>
     <intercept-url pattern="/login.jsp*" filters="none"/>
    <intercept-url pattern="/**" access="ROLE_USER" />
    <form-login login-page="/authentication"  login-processing-url="/static  
              /j_spring_security_check" authentication-failure 
              url="/login?login_error=t" />

</http>

Answer 3

Try 2 things

Add

< intercept-url pattern="/authentication" access="IS_AUTHENTICATED_ANONYMOUSLY" />

Add default-target-url in your form-login tag

default-target-url='/home.xhtml'

One more thing you are using a custom login page and your http auto-config="true" change it to false if you are using custom login page

So your security config should be like this (login-processing-url is also not needed)

<http auto-config="false" use-expressions="false">
<intercept-url pattern="/**" access="ROLE_USER" />
 < intercept-url pattern="/authentication" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<form-login login-page="/authentication"   authentication-failure 
          url="/login?login_error=t" default-target-url='/home.xhtml'/>

Answer 4

It usually makes sense to protect only proper web pages which would be JSF rendered ones here. For sure you should not intercept all urls or else login won't be possible. This assumes you have a working login page under /authentication.

<http auto-config="true" use-expressions="false">
    <intercept-url pattern="/**/*.faces" access="ROLE_USER" />
    <intercept-url pattern="/**/*.jsf" access="ROLE_USER" />
    <intercept-url pattern="/**/*.xhtml" access="ROLE_USER" />
    <form-login login-page="/authentication"  login-processing-url="/static  
              /j_spring_security_check" authentication-failure 
              url="/login?login_error=t" />

</http>