Spring Security: Login authentication controller

Question

I am trying to redirect back to the login page when the authentication fails along with some error messages. I am wondering how do we pass some sort of parameters to /login in the security-context.xml saying that this is unauthenticated and then attach some error text ?

<security:form-login login-page="/login"
                     username-parameter="email"
                     password-parameter="password"
                     default-target-url="/member/"
                     authentication-failure-url="/login"/>

/login is actually a Controller for returning the ModelAndView.

subodh · Accepted Answer · 2013-04-11 06:20:41Z

4

Try simply appending a query parameter to the authentication-failure-url like this:

<security:form-login login-page="/login"
                     username-parameter="email"
                     password-parameter="password"
                     default-target-url="/member/"
                     authentication-failure-url="/login?error=true" />

Then, your login handler method can receive that optional query parameter, and manipulate the response accordingly. Something along these lines:

@RequestMapping(value = "/login", method = RequestMethod.GET)
public String getLoginPage(
        @RequestParam(required = false) boolean error,
        ModelMap model) {

    model.put("error", error ? "You have entered an invalid username or password!" : "");

    return "loginpage";
}

edited Apr 11, 2013 at 6:20

subodh

6,15813 gold badges53 silver badges73 bronze badges

answered Apr 10, 2013 at 18:44

zagyi

17.6k4 gold badges54 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

David Le Moing · Accepted Answer · 2013-04-11 13:17:54Z

You can also use an AuthenticationFailureHandler that will react differently depending on the AuthenticationException you will receive.

<security:form-login login-page="/login"
    username-parameter="email"
    password-parameter="password"
    default-target-url="/member/" 
    authentication-failure-handler-ref="myAuthenticationFailudeHandler"/>

For instance, it can redirect the user to .../login?errorCode=errorCode1

Then you can modify the controller to react to different error codes :

@RequestMapping(value = "/login", method = RequestMethod.GET)
public String getLoginPage(
        ..., 
        @RequestParam(value="errorCode", required = false) String errorCode, 
        Model model, 
        ... ) {
    if (errorCode != null) {
        model.put("error", translateErrorCode(errorCode));
    }
    ...

pgardunoc · Accepted Answer · 2013-04-13 06:14:32Z

1

I usually do this

<security:form-login login-page="/" authentication-failure-url="/myapp/auth/login?error=true" default-target-url="/myapp/main/default"/>

And the controller:

@RequestMapping(value = "/auth/login", method = RequestMethod.GET)
public ModelAndView indexp(@RequestParam(value = "error", required = false) boolean error, ModelMap model, Principal principal) {
ModelAndView mv = new ModelAndView("view");
// return your view....
}

The parameter helps to display an error message.

answered Apr 13, 2013 at 6:14

pgardunoc

3312 silver badges8 bronze badges

Collectives™ on Stack Overflow

Spring Security: Login authentication controller

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related