Spring Security loginPage Vs loginProcessingURL

The line loginPage("/login") instructs Spring Security

• when authentication is required, redirect the browser to /login
• we are in charge of rendering the login page when /login is requested
• when authentication attempt fails, redirect the browser to /login?error (since we have not specified otherwise)
• we are in charge of rendering a failure page when /login?error is requested
• when we successfully logout, redirect the browser to /login?logout (since we have not specified otherwise)
• we are in charge of rendering a logout confirmation page when /login?logout is requested

AND

.loginProcessingUrl("/login/process")

tells Spring Security to process the submitted credentials when sent the specified path and, by default, redirect user back to the page user came from. It will not pass the request to Spring MVC and your controller.

Refer documentation

Purpose of loginPage()

The loginPage() tells the framework where the user will be redirected when login is required. For example when you are not authorized to the page, you get redirected to this page. This page performs the login activity, for example when you implement a loginForm() or oauth2Login() like in my code using Google OAuth2,this page redirects to google login.

http.anonymous().and()
            .authorizeRequests().antMatchers("/images**").permitAll().and()
            .authorizeRequests().anyRequest().authenticated().and()
            .oauth2Login()
            .successHandler((request, response, authentication) -> {
                request.authenticate(response);
            })
            .loginPage("/oauth2/authorization/google")
            .loginProcessingUrl("/login")

Purpose of loginProcessingUrl()

The loginProcessingUrl() is the method that automatically set the rule antMatchers("/thisUrl").permitAll() to this URL so that when the response is returned (code, state, token, etc.) will be allowed to be GETed and this response is processed as you can see in the authenticate method of the request. Something more important is that this loginProcessingUrl() tells that the response should be processed to this URL. Without this the request.authenticate(response) will not be executed and authentication will not be returned or otherwise you implement another algorithm.

May the following code segment from spring security source code will help you：

loginPage the login page to redirect to if authentication is required

loginProcessingUrl the URL to validate username and password

 DEFAULT_LOGIN_PAGE_URL = "/login"

/**
     * Updates the default values for authentication.
     *
     * @throws Exception
     */
    protected final void updateAuthenticationDefaults() {
        if (loginProcessingUrl == null) {
            loginProcessingUrl(loginPage);
        }
             //...
        }