ajax login with spring webMVC and spring security

user_326389 0
Viewed 19596

I've been using Spring Security 3.0 for our website login mechanism using a dedicated login webpage. Now I need that login webpage to instead be a lightbox/popup window on every webpage in our site where upon logging in I get an AJAX result whether it was successful or not. What's the best way to go about this with Spring Security and Spring webmvc 3.0?

spring-security spring-mvc model-view-controller ajax
2 Answers

I did something similar (thanks axtavt): 

public class AjaxAuthenticationSuccessHandler extends
    SimpleUrlAuthenticationSuccessHandler {

public void onAuthenticationSuccess(HttpServletRequest request,
        HttpServletResponse response, Authentication auth)
        throws IOException, ServletException {
    if ("XMLHttpRequest".equals(request.getHeader("X-Requested-With"))) {
        response.getWriter().print(
                "{success:true, targetUrl : \'"
                        + this.getTargetUrlParameter() + "\'}");
        response.getWriter().flush();
    } else {
        super.onAuthenticationSuccess(request, response, auth);
    }
}}

I chose to extend the simple success handler for the default behavior on non-Ajax requests. Here's the XML to make it work:

<http auto-config="false" use-expressions="true" entry-point-ref="authenticationProcessingFilterEntryPoint">
    <custom-filter position="FORM_LOGIN_FILTER" ref="authenticationFilter" />
...
...
</http>

<beans:bean id="authenticationProcessingFilterEntryPoint"
    class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <beans:property name="loginFormUrl" value="/index.do" />
    <beans:property name="forceHttps" value="false" />
</beans:bean>

<beans:bean id="authenticationFilter" class=
    "org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
    <beans:property name="authenticationManager" ref="authenticationManager"/>
    <beans:property name="filterProcessesUrl" value="/j_spring_security_check"/>
    <beans:property name="sessionAuthenticationStrategy" ref="sas" />
    <beans:property name="authenticationFailureHandler" ref="failureHandler"/>
    <beans:property name="authenticationSuccessHandler" ref="successHandler"/>
</beans:bean>

<beans:bean id="successHandler" class="foo.AjaxAuthenticationSuccessHandler">
    <beans:property name="defaultTargetUrl" value="/login.html"/>
</beans:bean>

<beans:bean id="failureHandler" class="foo.AjaxAuthenticationFailureHandler" />
user_6070240
Related