I am using spring mvc + security to build a simple web app and currently having issues with the login. I am not able to exclude the login page from the spring security if i want to secure /** (everything basically). This is how my config look like:
spring.security.xml
<http pattern="/login" security="none"/>
<http pattern="/view_register.htm" security="none"/>
<http>
<intercept-url pattern="/**" access="ROLE_USER" />
<form-login login-page="/login" default-target-url="/game" authentication-failure-url="/failedlogin" />
<logout logout-success-url="/login" />
</http>
LoginController
@Controller
public class LoginLogoutController {
@RequestMapping(value="/login", method = RequestMethod.GET)
public String login(ModelMap model) {
return "login";
}
@RequestMapping(value="/failedlogin", method = RequestMethod.GET)
public String loginerror(ModelMap model) {
model.addAttribute("error", "true");
return "login";
}
}
login.jsp
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<head>
<title>Login Page</title>
<style>
.errorblock {
color: #ff0000;
background-color: #ffEEEE;
border: 3px solid #ff0000;
padding: 8px;
margin: 16px;
}
</style>
</head>
<body onload='document.f.j_username.focus();'>
<h3>Login with Username and Password (Custom Page)</h3>
<c:if test="${not empty error}">
<div class="errorblock">
Your login attempt was not successful, try again.<br /> Caused :
${sessionScope["SPRING_SECURITY_LAST_EXCEPTION"].message}
</div>
</c:if>
<form name='f' action="<c:url value='j_spring_security_check' />"
method='POST'>
<table>
<tr>
<td>User:</td>
<td><input type='text' name='j_username' value=''>
</td>
</tr>
<tr>
<td>Password:</td>
<td><input type='password' name='j_password' />
</td>
</tr>
<tr>
<td colspan='2'><input name="submit" type="submit"
value="submit" />
</td>
</tr>
<tr>
<td>Don't have an account yet.</td>
<td> <a href="<c:url value="view_register.htm" />" > Register here</a>
</td>
</tr>
</table>
</form>
</body>
</html>
I want to secure the whole app and exlude the login and the registration page. With my current config the whole security behaves very strangly. If i enter wrong credentials the
@RequestMapping(value="/login", method = RequestMethod.GET)
public String login(ModelMap model) {
is called and from the other hand if i enter the correct username/pass the login failed controller method is called.
Found out that if i modify the
<intercept-url pattern="/**" access="ROLE_USER" />
to
<intercept-url pattern="/game*" access="ROLE_USER" />
and remove the
<http pattern="/login" security="none"/>
everything is working as expected. Its very strange and can't really figure out why this is happening.
EDIT
Just created a tiny version of my sample project (maven) and uploaded to: fileswap. Any help or suggestion will be really cool as i am still confused.