Java configuration of Spring security does not recognize /j_spring_security_check

Question

I have a webapp where I've used Java config for Spring security. The problem is that if I do not explicitly specify /j_spring_security_check as the login processing URL, it will fail. I end up getting the following in the logs:

DEBUG: [Aug-02 17:16:10,907] security.web.FilterChainProxy - /j_spring_security_check at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
DEBUG: [Aug-02 17:16:10,907] security.web.FilterChainProxy - /j_spring_security_check at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
DEBUG: [Aug-02 17:16:10,907] security.web.FilterChainProxy - /j_spring_security_check at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/login.html'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/auth-failure.html'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/favicon.ico'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/css/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/js/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/img/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/reader/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/script/read/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Checking match of request : '/j_spring_security_check'; against '/mobile/**'
DEBUG: [Aug-02 17:16:10,907] util.matcher.AntPathRequestMatcher - Request '/j_spring_security_check' matched by universal pattern '/**'
DEBUG: [Aug-02 17:16:10,907] access.intercept.FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /j_spring_security_check; Attributes: [hasRole('ROLE_USER')]
DEBUG: [Aug-02 17:16:10,907] access.intercept.FilterSecurityInterceptor - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@6fa8dbd0: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffdaa08: RemoteIpAddress: 127.0.0.1; SessionId: 715AFC0DB28725B1A882DF649173A566; Granted Authorities: ROLE_ANONYMOUS
DEBUG: [Aug-02 17:16:10,907] access.vote.AffirmativeBased - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@329b7920, returned: -1
DEBUG: [Aug-02 17:16:10,907] web.access.ExceptionTranslationFilter - Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied

As you can see, it can't match /j_spring_security_check at all and so it says that access is denied and redirects back to the login page. However, if I explicitly add /j_spring_security_check like so:

http.formLogin()
        .loginProcessingUrl("/j_spring_security_check")
        ...
        ...                   

It works. This doesn't seem right to me since I never had to do this in the XML-based config. Furthermore, I don't see this in any of the examples either. What am I doing wrong?

My security-configuration class is as follows:

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    public void configure(AuthenticationManagerBuilder builder) throws Exception {
        builder.userDetailsService(new CustomUserDetailsService()).passwordEncoder(new PlaintextPasswordEncoder()); //plaintext is on purpose; this is a toy app
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable() // toy app so I'm just trying to get this to work
            .authorizeRequests()
                .antMatchers(
                        "/login.html",
                        "/auth-failure.html",
                        "/favicon.ico",
                        "/css/**",
                        "/js/**",
                        "/img/**",
                        "/reader/**",
                        "/script/read/**",
                        "/mobile/**").permitAll()
                .antMatchers("/**").hasRole("USER")
                .anyRequest().authenticated();

        http.formLogin()
                .loginProcessingUrl("/j_spring_security_check")
                .loginPage("/login.html")
                .defaultSuccessUrl("/editor/")
                .failureUrl("/auth-failure.html");
    }
}

Answer 1

Java config and XML-based config have different default URLs for security reason. See here for details.

It says:

POST /login authenticates the user instead of /j_spring_security_check