CODEWITHSUNDEEP
springjspspring-security
Vítor Nóbrega
Vítor Nóbrega

Reputation: 1213

Spring redirect view is not working

I am using Spring Controllers to show my jsp views and Spring security.

In security context, all users can access to /login (login.jsp) but only authenticated users can access to /home (home.jsp).

When i remove the session id from browser cookies, the next request in the app should redirect to login page.

My method to show login page in controller is:

@RequestMapping(value = {"/login","/login.do"})
public ModelAndView showLoginForm() {

    String username = getUsername();
    if(!username.equals("anonymousUser")){
        return new ModelAndView("redirect:/home"); 
    }
   return new ModelAndView("login");
}

My url is on /home but when i try to redirect to login using this function return new ModelAndView("login") the browsers stay with the same url.

My spring security config

<http  entry-point-ref="loginEntryPoint"
    use-expressions="true" create-session="always">
    <session-management
        session-authentication-strategy-ref="sas" />
    <intercept-url pattern="/" access="permitAll" />
    <intercept-url pattern="/login.do" access="permitAll" />
    <intercept-url pattern="/login" access="permitAll" />
    <intercept-url pattern="/accessDenied.do" access="permitAll" />
    <intercept-url pattern="/app/**" access="permitAll" />
    <intercept-url pattern="/signup/createuser" access="permitAll" />
    <intercept-url pattern="/changepassword/changefirstpassword" access="permitAll" />
    <intercept-url pattern="/recoverpassword/recoverPasswordRequest" access="permitAll" />  
    <intercept-url pattern="/resources/**" access="permitAll"/>
    <intercept-url pattern="/**" access="authenticated" />
    <access-denied-handler error-page="/accessDenied.do" />
    <custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
    <custom-filter position="FORM_LOGIN_FILTER" ref="domainFormLoginFilter" />
    <logout success-handler-ref="myLogoutSuccessHandler" />
</http>

Why my browser doesnt redirect to login page? tks

Upvotes: 0

Views: 1602

Answers (1)

M. Deinum
M. Deinum

Reputation: 125252

First remove your controller and add the following to your security configuration.

<sec:intercept-url pattern="/home" access="isAuthenticated()" />
<sec:intercept-url pattern="/login" access="permitAll()" />

Work with the framework not against or around it...

Upvotes: 1

Related Questions