CODEWITHSUNDEEP
springspring-mvcspring-security
AlpacaMan
AlpacaMan

Reputation: 513

Spring Security 5 authentication always return 302

I'm using Spring-Security 5 to secure my web app. I access /login.jsp and fill in username and password, and then click "Log in" to submit the form, and then was redirected to /login.jsp. I see the reponse status code of that http traffic in fiddler is 302.

SecurityConfig class:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private DataSource dataSource;

    @Autowired
    protected SecurityConfig(DataSource dataSource
    ) {
        this.dataSource = dataSource;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login.jsp")
                .loginProcessingUrl("/login")
                .permitAll();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication()
                .dataSource(dataSource)
                .usersByUsernameQuery("select name userName, password, enabled from user where name=?")
                .authoritiesByUsernameQuery("select name userName 'ROLE_USER' from user where name=?")
        ;
    }
}

login.jsp:

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ taglib prefix="c"
           uri="http://java.sun.com/jsp/jstl/core" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
<c:url value="/login" var="loginUrl"/>
<form action="${loginUrl}" method="post"> 1
    <c:if test="${param.error != null}"> 2
        <p>
            Invalid username and password.
        </p>
    </c:if>
    <c:if test="${param.logout != null}"> 3
        <p>
            You have been logged out.
        </p>
    </c:if>
    <p>
        <label for="username">Username</label>
        <input type="text" id="username" name="username"/> 4
    </p>
    <p>
        <label for="password">Password</label>
        <input type="password" id="password" name="password"/> 5
    </p>
    <button type="submit" class="btn">Log in</button>
</form>
</body>
</html>

Upvotes: 8

Views: 28273

Answers (5)

BJ5
BJ5

Reputation: 512

This is because spring default authentication success handler looks for a url to redirect. What one can do is use a custom AuthenticationSuccessHandler

i have used below and no redirects are happening.

public class AppAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler{
    protected void handle(HttpServletRequest request, HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {
    }

}

Then define the bean and give it in the configure method for security

@Bean
public AuthenticationSuccessHandler appAuthenticationSuccessHandler(){
     return new AppAuthenticationSuccessHandler();
}

Configure method

http
  .authorizeRequests()
  .antMatchers("/login*")
  .permitAll()
  .anyRequest()
  .authenticated()
  .and()
  .formLogin()
  .successHandler(appAuthenticationSuccessHandler());

Upvotes: 6

Prosenjit
Prosenjit

Reputation: 459

Use successHandler to set the referer true. This does the trick for me. Else I am also getting 302.

In securityConfig need to add the below code.

@Override
protected void configure(HttpSecurity http) throws Exception {
http
  .authorizeRequests()
  .antMatchers("/login*")
  .permitAll()
  .anyRequest()
  .authenticated()
  .and()
  .formLogin()
  .successHandler(new RefererRedirectionAuthenticationSuccessHandler ());
}


import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;

public class RefererRedirectionAuthenticationSuccessHandler extends 
SimpleUrlAuthenticationSuccessHandler {

public RefererRedirectionAuthenticationSuccessHandler() {
    super();
    setUseReferer(true);
}

}

}

Check the below link: http://www.baeldung.com/spring-security-redirect-login

Upvotes: 0

Feng Zhang
Feng Zhang

Reputation: 11

  • the "loginPage url" same of the "form action"
  • show me code

java config:

http.formLogin().loginPage("/login.html")

html

<form action="/login.html" method="post">

you just need write controller for "/login.html", by http GET method, Leave the rest to “spring”

docs: https://docs.spring.io/spring-security/site/docs/5.3.6.RELEASE/reference/html5/#servlet-authentication-form

the UsernamePasswordAuthenticationFilter match /login.html by http POST method

My English is not good, Hope I can help you

Upvotes: 1

Henri Reydon
Henri Reydon

Reputation: 11

I don't known if this issue is always active but if this can help someone...

What's works for me was to replace 

.formLogin()

by

.httpBasic();

in my WebSecurityConfigurerAdapter class.

So my security config looks like this : 

protected void configure(final HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/login", "/actuator/**", "/clients/refresh", "/oauth/token/revokeById/**", "/tokens/**")
            .permitAll()
            .anyRequest()
            .authenticated()
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .httpBasic();
}

Upvotes: 0

Andrey M. Stepanov
Andrey M. Stepanov

Reputation: 499

I had this problem until I turned csrf-check off by including .csrf().disable() in configure (HttpSecurity) method. If you don't have it off then provide csrf token as hidden form field.

... though I see that you have it off disabled

Upvotes: 1

Related Questions