Spring Failover Redirection Failover Authentication with Parameter

Question

I have a problem with Spring Security Authentication Failure Handler Redirect with parameter.

In security configuration, when I use

failureUrl("/login.html?error=true")

its ok, it works. When I use my own authentication error handler, I tried:

getRedirectStrategy().sendRedirect(request, response, "/login.html?error=true");

or

response.sendRedirect(request.getContextPath() + "/login.html?error=true");

they always return: url/login.html

I do not know what is wrong, why the parameter ( ?error=true) does not show ?

Info: I am using Spring + JSF + Hibernate + Spring Security

@Override
protected void configure(HttpSecurity http) throws Exception {

    http
        .authorizeRequests()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login.html")
            .usernameParameter("j_username")
            .passwordParameter("j_password")
            .loginProcessingUrl("/j_spring_security_check")
            .failureHandler(customAuthenticationFailureHandler)// .failureUrl("/login.html?error=true")//.successHandler(authSuccsessHandler)
            .defaultSuccessUrl("/dashboard.html")
            .permitAll()
            .and()
        .logout()
            .invalidateHttpSession(true)
            .logoutSuccessUrl("/")
            .permitAll()
            .and()
        .exceptionHandling()
            .accessDeniedPage("/access.html")
            .and()
        .headers()
            .defaultsDisabled()
            .frameOptions()
            .sameOrigin()
            .cacheControl();

    http
        .csrf().disable();
}

This is the cstom authentication failure handler:

@Component
public class CustomAuthFailureHandler extends SimpleUrlAuthenticationFailureHandler {

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
            AuthenticationException exception) throws IOException, ServletException {
        getRedirectStrategy().sendRedirect(request, response, "/login.html?error=true");

    }
}

In some cases, I will change the parameter.

Answer 1

URL /login.html?error=true, (/login.html).

AbstractAuthenticationFilterConfigurer#permitAll ( ) URL- , :

URL- failureUrl(String), HttpSecurityBuilder, getLoginPage() getLoginProcessingUrl() .

AbstractRequestMatcherRegistry#antMatchers:

AntPathRequestMatcher, , HttpMethod .

ExpressionUrlAuthorizationConfigurer.AuthorizedUrl#permitAll:

, URL- -.

URL /login.html?error=true, AntPathRequestMatcher query string:

ant URL- (servletPath + pathInfo) HttpServletRequest. URL- , , .

:

@Override
protected void configure(HttpSecurity http) throws Exception {

    http
        .authorizeRequests()
            .antMatchers("/login.html").permitAll()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login.html")
            .usernameParameter("j_username")
            .passwordParameter("j_password")
            .loginProcessingUrl("/j_spring_security_check")
            .failureHandler(customAuthenticationFailureHandler)// .failureUrl("/login.html?error=true")//.successHandler(authSuccsessHandler)
            .defaultSuccessUrl("/dashboard.html")
            .permitAll()
            .and()
        .logout()
            .invalidateHttpSession(true)
            .logoutSuccessUrl("/")
            .permitAll()
            .and()
        .exceptionHandling()
            .accessDeniedPage("/access.html")
            .and()
        .headers()
            .defaultsDisabled()
            .frameOptions()
            .sameOrigin()
            .cacheControl();

    http
        .csrf().disable();
}