Spring Security redirect to previous page after successful login

Question

I know this question has been asked before, however I'm facing a particular issue here.

I use spring security 3.1.3.

I have 3 possible login cases in my web application:

Login via the login page : OK.
Login via a restricted page : OK too.
Login via a non-restricted page : not OK... a "product" page can be accessed by everybody, and a user can post a comment if he's logged. So a login form is contained in the same page in order to allow users to connect.

The problem with case 3) is that I can't manage to redirect users to the "product" page. They get redirected to the home page after a successful login, no matter what.

Notice that with case 2) the redirection to the restricted page works out of the box after successful login.

Here's the relevant part of my security.xml file:

<!-- Authentication policy for the restricted page  -->
<http use-expressions="true" auto-config="true" pattern="/restrictedPage/**">
    <form-login login-page="/login/restrictedLogin" authentication-failure-handler-ref="authenticationFailureHandler" />
    <intercept-url pattern="/**" access="isAuthenticated()" />
</http>

<!-- Authentication policy for every page -->
<http use-expressions="true" auto-config="true">
    <form-login login-page="/login" authentication-failure-handler-ref="authenticationFailureHandler" />
    <logout logout-url="/logout" logout-success-url="/" />
</http>

I suspect the "authentication policy for every page" to be responsible for the problem. However, if I remove it I can't login anymore... j_spring_security_check sends a 404 error.

EDIT:

Thanks to Ralph, I was able to find a solution. So here's the thing: I used the property

<property name="useReferer" value="true"/>

that Ralph showed me. After that I had a problem with my case 1) : when logging via the login page, the user stayed in the same page (and not redirected to the home page, like it used to be). The code until this stage was the following:

<!-- Authentication policy for login page -->
<http use-expressions="true" auto-config="true" pattern="/login/**">
    <form-login login-page="/login" authentication-success-handler-ref="authenticationSuccessHandlerWithoutReferer" />
</http>

<!-- Authentication policy for every page -->
<http use-expressions="true" auto-config="true">
    <form-login login-page="/login" authentication-failure-handler-ref="authenticationFailureHandler" />
    <logout logout-url="/logout" logout-success-url="/" authentication-success-handler-ref="authenticationSuccessHandler"/>
</http>

<beans:bean id="authenticationSuccessHandler" class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
    <!-- After login, return to the last visited page -->
    <beans:property name="useReferer" value="true" />
</beans:bean>

<beans:bean id="authenticationSuccessHandlerWithoutReferer" class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
    <!-- After login, stay to the same page -->
    <beans:property name="useReferer" value="false" />
</beans:bean>

This should work, in theory at least, but it wasn't. I still dont know why, so if someone has an answer on this, I will gladly create a new topic to allo him to share his solution.

In the meantime, I came to a workaround. Not the best solution, but like I said, if someone has something better to show, I'm all ears. So this is the new authentication policy for the login page :

<http use-expressions="true" auto-config="true" pattern="/login/**" >
    <intercept-url pattern="/**" access="isAnonymous()" />
    <access-denied-handler error-page="/"/>
</http>

The solution here is pretty obvious: the login page is allowed only for anonymous users. Once a user is connected, the error handler redirects him to the home page.

I did some tests, and everything seems to be working nicely.

User · Answer

Back to previous page after succesfull login, we can use following custom authentication manager as follows:

<!-- enable use-expressions -->
    <http auto-config="true" use-expressions="true">
        <!-- src** matches: src/bar.c src/baz.c src/test/bartest.c-->
        <intercept-url pattern="/problemSolution/home/**" access="hasRole('ROLE_ADMIN')"/>
        <intercept-url pattern="favicon.ico" access="permitAll"/>
        <form-login
                authentication-success-handler-ref="authenticationSuccessHandler"
                always-use-default-target="true"
                login-processing-url="/checkUser"
                login-page="/problemSolution/index"

                default-target-url="/problemSolution/home"
                authentication-failure-url="/problemSolution/index?error"
                username-parameter="username"
                password-parameter="password"/>
        <logout logout-url="/problemSolution/logout"
                logout-success-url="/problemSolution/index?logout"/>
        <!-- enable csrf protection -->
        <csrf/>
    </http>

    <beans:bean id="authenticationSuccessHandler"
            class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
        <beans:property name="defaultTargetUrl" value="/problemSolution/home"/>
    </beans:bean>

    <!-- Select users and user_roles from database -->
    <authentication-manager>
        <authentication-provider user-service-ref="customUserDetailsService">
            <password-encoder hash="plaintext">
            </password-encoder>
        </authentication-provider>
    </authentication-manager>

CustomUserDetailsService class

@Service
public class CustomUserDetailsService implements UserDetailsService {

        @Autowired
        private UserService userService;

        public UserDetails loadUserByUsername(String userName)
                        throws UsernameNotFoundException {
                com.codesenior.telif.local.model.User domainUser = userService.getUser(userName);

                boolean enabled = true;
                boolean accountNonExpired = true;
                boolean credentialsNonExpired = true;
                boolean accountNonLocked = true;

                return new User(
                                domainUser.getUsername(),
                                domainUser.getPassword(),
                                enabled,
                                accountNonExpired,
                                credentialsNonExpired,
                                accountNonLocked,
                                getAuthorities(domainUser.getUserRoleList())
                );
        }

        public Collection<? extends GrantedAuthority> getAuthorities(List<UserRole> userRoleList) {
                return getGrantedAuthorities(getRoles(userRoleList));
        }

        public List<String> getRoles(List<UserRole> userRoleList) {

                List<String> roles = new ArrayList<String>();

                for(UserRole userRole:userRoleList){
                        roles.add(userRole.getRole());
                }
                return roles;
        }

        public static List<GrantedAuthority> getGrantedAuthorities(List<String> roles) {
                List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();

                for (String role : roles) {
                        authorities.add(new SimpleGrantedAuthority(role));
                }
                return authorities;
        }

}

User Class

import com.codesenior.telif.local.model.UserRole;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;


@Service
public class CustomUserDetailsService implements UserDetailsService {

        @Autowired
        private UserService userService;

        public UserDetails loadUserByUsername(String userName)
                        throws UsernameNotFoundException {
                com.codesenior.telif.local.model.User domainUser = userService.getUser(userName);

                boolean enabled = true;
                boolean accountNonExpired = true;
                boolean credentialsNonExpired = true;
                boolean accountNonLocked = true;

                return new User(
                                domainUser.getUsername(),
                                domainUser.getPassword(),
                                enabled,
                                accountNonExpired,
                                credentialsNonExpired,
                                accountNonLocked,
                                getAuthorities(domainUser.getUserRoleList())
                );
        }

        public Collection<? extends GrantedAuthority> getAuthorities(List<UserRole> userRoleList) {
                return getGrantedAuthorities(getRoles(userRoleList));
        }

        public List<String> getRoles(List<UserRole> userRoleList) {

                List<String> roles = new ArrayList<String>();

                for(UserRole userRole:userRoleList){
                        roles.add(userRole.getRole());
                }
                return roles;
        }

        public static List<GrantedAuthority> getGrantedAuthorities(List<String> roles) {
                List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();

                for (String role : roles) {
                        authorities.add(new SimpleGrantedAuthority(role));
                }
                return authorities;
        }

}

UserRole Class

@Entity
public class UserRole {
        @Id
        @GeneratedValue
        private Integer userRoleId;

        private String role;

        @ManyToMany(fetch = FetchType.LAZY, mappedBy = "userRoleList")
        @JsonIgnore
        private List<User> userList;

        public Integer getUserRoleId() {
                return userRoleId;
        }

        public void setUserRoleId(Integer userRoleId) {
                this.userRoleId= userRoleId;
        }

        public String getRole() {
                return role;
        }

        public void setRole(String role) {
                this.role= role;
        }

        @Override
        public String toString() {
                return String.valueOf(userRoleId);
        }

        public List<User> getUserList() {
                return userList;
        }

        public void setUserList(List<User> userList) {
                this.userList= userList;
        }
}

User · Answer

The following generic solution can be used with regular login, a Spring Social login, or most other Spring Security filters.

In your Spring MVC controller, when loading the product page, save the path to the product page in the session if user has not been logged in. In XML config, set the default target url. For example:

In your Spring MVC controller, the redirect method should read out the path from the session and return redirect:<my_saved_product_path>.

So, after user logs in, they'll be sent to /redirect page, which will promptly redirect them back to the product page that they last visited.

User · Answer

I found Utku   zdemir s solution works to some extent  but kind of defeats the purpose of the saved request since the session attribute will take precedence over it  This means that redirects to secure pages will not work as intended - after login you will be sent to the page you were on instead of the redirect target  So as an alternative you could use a modified version of SavedRequestAwareAuthenticationSuccessHandler instead of extending it  This will allow you to have better control over when to use the session attribute   Here is an example   private static class MyCustomLoginSuccessHandler extends SimpleUrlAuthenticationSuccessHandler        private RequestCache requestCache   new HttpSessionRequestCache          Override     public void onAuthenticationSuccess HttpServletRequest request  HttpServletResponse response              Authentication authentication  throws ServletException  IOException           SavedRequest savedRequest   requestCache getRequest request  response            if  savedRequest    null                HttpSession session   request getSession                if  session    null                    String redirectUrl    String  session getAttribute  url prior login                    if  redirectUrl    null                        session removeAttribute  url prior login                        getRedirectStrategy   sendRedirect request  response  redirectUrl                     else                       super onAuthenticationSuccess request  response  authentication                                   else                   super onAuthenticationSuccess request  response  authentication                              return                     String targetUrlParameter   getTargetUrlParameter            if  isAlwaysUseDefaultTargetUrl                       targetUrlParameter    null  amp  amp  StringUtils hasText request getParameter targetUrlParameter                   requestCache removeRequest request  response               super onAuthenticationSuccess request  response  authentication                return                     clearAuthenticationAttributes request               Use the DefaultSavedRequest URL         String targetUrl   savedRequest getRedirectUrl            logger debug  Redirecting to DefaultSavedRequest Url      targetUrl           getRedirectStrategy   sendRedirect request  response  targetUrl             Also  you don t want to save the referrer when authentication has failed  since the referrer will then be the login page itself  So check for the error param manually or provide a separate RequestMapping like below    RequestMapping value     login   params    error   public String loginError            Don t save referrer here

User · Answer

What happens after login  to which url the user is redirected  is handled by the AuthenticationSuccessHandler   This interface  a concrete class implementing  it is SavedRequestAwareAuthenticationSuccessHandler  is invoked by the AbstractAuthenticationProcessingFilter or one of its subclasses like  UsernamePasswordAuthenticationFilter  in the method successfulAuthentication   So in order to have an other redirect in case 3 you have to subclass SavedRequestAwareAuthenticationSuccessHandler and make it to do what you want     Sometimes  depending on your exact usecase  it is enough to enable the useReferer flag of AbstractAuthenticationTargetUrlRequestHandler which is invoked by SimpleUrlAuthenticationSuccessHandler  super class of SavedRequestAwareAuthenticationSuccessHandler     lt bean id  authenticationFilter        class  org springframework security web authentication UsernamePasswordAuthenticationFilter  gt       lt property name  filterProcessesUrl  value   login j spring security check    gt       lt property name  authenticationManager  ref  authenticationManager    gt       lt property name  authenticationSuccessHandler  gt           lt bean class  org springframework security web authentication SavedRequestAwareAuthenticationSuccessHandler  gt               lt property name  useReferer  value  true   gt           lt  bean gt       lt  property gt       lt property name  authenticationFailureHandler  gt           lt bean class  org springframework security web authentication SimpleUrlAuthenticationFailureHandler  gt               lt property name  defaultFailureUrl  value   login login error t    gt           lt  bean gt       lt  property gt   lt  bean gt

User · Answer

I ve custom OAuth2 authorization and request getHeader  quot Referer quot   is not available at poit of decision  But security request already saved in ExceptionTranslationFilter sendStartAuthentication  protected void sendStartAuthentication HttpServletRequest request                 requestCache saveRequest request  response    So  all what we need is share requestCache as Spring bean   Bean public RequestCache requestCache        return new HttpSessionRequestCache        Override protected void configure HttpSecurity http  throws Exception      http authorizeRequests               requestCache   requestCache requestCache    and                  and use it wheen authorization is finished   Autowired private RequestCache requestCache   public void authenticate HttpServletRequest req  HttpServletResponse resp                SavedRequest savedRequest   requestCache getRequest req  resp       resp sendRedirect savedRequest    null  amp  amp   quot GET quot  equals savedRequest getMethod            savedRequest getRedirectUrl      quot defaultURL quot

User · Answer

I want to extend Olcay s nice answer  His approach is good  your login page controller should be like this to put the referrer url into session    RequestMapping value     login   method   RequestMethod GET  public String loginPage HttpServletRequest request  Model model        String referrer   request getHeader  Referer        request getSession   setAttribute  url prior login   referrer          some other stuff     return  login       And you should extend SavedRequestAwareAuthenticationSuccessHandler and override its onAuthenticationSuccess HttpServletRequest request  HttpServletResponse response  Authentication authentication  method  Something like this   public class MyCustomLoginSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler       public MyCustomLoginSuccessHandler String defaultTargetUrl            setDefaultTargetUrl defaultTargetUrl               Override     public void onAuthenticationSuccess HttpServletRequest request  HttpServletResponse response  Authentication authentication  throws ServletException  IOException           HttpSession session   request getSession            if  session    null                String redirectUrl    String  session getAttribute  url prior login                if  redirectUrl    null                       we do not forget to clean this attribute from session                 session removeAttribute  url prior login                       then we redirect                 getRedirectStrategy   sendRedirect request  response  redirectUrl                 else                   super onAuthenticationSuccess request  response  authentication                           else               super onAuthenticationSuccess request  response  authentication                       Then  in your spring configuration  you should define this custom class as a bean and use it on your security configuration  If you are using annotation config  it should look like this  the class you extend from WebSecurityConfigurerAdapter     Bean public AuthenticationSuccessHandler successHandler         return new MyCustomLoginSuccessHandler   yourdefaultsuccessurl        In configure method    Override protected void configure HttpSecurity http  throws Exception       http                bla bla              formLogin                    loginPage   login                    usernameParameter  username                    passwordParameter  password                    successHandler successHandler                     permitAll                  etc etc

User · Answer

In order to redirect to a specific page no matter what the user role is  one can simply use defaultSucessUrl in the configuration file of Spring   Override protected void configure HttpSecurity http  throws Exception                   http authorizeRequests           antMatchers  quot  admin quot   hasRole  quot ADMIN quot           and          formLogin    loginPage  quot  login quot                         defaultSuccessUrl  quot  admin quot  true         loginProcessingUrl  quot  authenticateTheUser quot          permitAll

User · Answer

You can use a Custom SuccessHandler extending SimpleUrlAuthenticationSuccessHandler for redirecting users to different URLs when login according to their assigned roles.

CustomSuccessHandler class provides custom redirect functionality:

package com.mycompany.uomrmsweb.configuration;

import java.io.IOException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
import org.springframework.stereotype.Component;

@Component
public class CustomSuccessHandler extends SimpleUrlAuthenticationSuccessHandler{

    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    @Override
    protected void handle(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
        String targetUrl = determineTargetUrl(authentication);

        if (response.isCommitted()) {
            System.out.println("Can't redirect");
            return;
        }

        redirectStrategy.sendRedirect(request, response, targetUrl);
    }

    protected String determineTargetUrl(Authentication authentication) {
        String url="";

        Collection<? extends GrantedAuthority> authorities =  authentication.getAuthorities();

        List<String> roles = new ArrayList<String>();

        for (GrantedAuthority a : authorities) {
            roles.add(a.getAuthority());
        }

        if (isStaff(roles)) {
            url = "/staff";
        } else if (isAdmin(roles)) {
            url = "/admin";
        } else if (isStudent(roles)) {
            url = "/student";
        }else if (isUser(roles)) {
            url = "/home";
        } else {
            url="/Access_Denied";
        }

        return url;
    }

    public void setRedirectStrategy(RedirectStrategy redirectStrategy) {
        this.redirectStrategy = redirectStrategy;
    }
    protected RedirectStrategy getRedirectStrategy() {
        return redirectStrategy;
    }

    private boolean isUser(List<String> roles) {
        if (roles.contains("ROLE_USER")) {
            return true;
        }
        return false;
    }

    private boolean isStudent(List<String> roles) {
        if (roles.contains("ROLE_Student")) {
            return true;
        }
        return false;
    }

    private boolean isAdmin(List<String> roles) {
        if (roles.contains("ROLE_SystemAdmin") || roles.contains("ROLE_ExaminationsStaff")) {
            return true;
        }
        return false;
    }

    private boolean isStaff(List<String> roles) {
        if (roles.contains("ROLE_AcademicStaff") || roles.contains("ROLE_UniversityAdmin")) {
            return true;
        }
        return false;
    }
}

Extending Spring SimpleUrlAuthenticationSuccessHandler class and overriding handle() method which simply invokes a redirect using configured RedirectStrategy [default in this case] with the URL returned by the user defined determineTargetUrl() method. This method extracts the Roles of currently logged in user from Authentication object and then construct appropriate URL based on there roles. Finally RedirectStrategy , which is responsible for all redirections within Spring Security framework , redirects the request to specified URL.

Registering CustomSuccessHandler using SecurityConfiguration class:

package com.mycompany.uomrmsweb.configuration;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    @Qualifier("customUserDetailsService")
    UserDetailsService userDetailsService;

    @Autowired
    CustomSuccessHandler customSuccessHandler;

    @Autowired
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(userDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
        .antMatchers("/", "/home").access("hasRole('USER')")
        .antMatchers("/admin/**").access("hasRole('SystemAdmin') or hasRole('ExaminationsStaff')")
        .antMatchers("/staff/**").access("hasRole('AcademicStaff') or hasRole('UniversityAdmin')")
        .antMatchers("/student/**").access("hasRole('Student')")  
                    .and().formLogin().loginPage("/login").successHandler(customSuccessHandler)
        .usernameParameter("username").passwordParameter("password")
        .and().csrf()
        .and().exceptionHandling().accessDeniedPage("/Access_Denied");
    }
}

successHandler is the class responsible for eventual redirection based on any custom logic, which in this case will be to redirect the user [to student/admin/staff ] based on his role [USER/Student/SystemAdmin/UniversityAdmin/ExaminationsStaff/AcademicStaff].

User · Answer

I have following solution and it worked for me.

Whenever login page is requested, write the referer value to the session:

@RequestMapping(value="/login", method = RequestMethod.GET)
public String login(ModelMap model,HttpServletRequest request) {

    String referrer = request.getHeader("Referer");
    if(referrer!=null){
        request.getSession().setAttribute("url_prior_login", referrer);
    }
    return "user/login";
}

Then, after successful login custom implementation of SavedRequestAwareAuthenticationSuccessHandler will redirect user to the previous page:

HttpSession session = request.getSession(false);
if (session != null) {
    url = (String) request.getSession().getAttribute("url_prior_login");
}

Redirect the user:

if (url != null) {
    response.sendRedirect(url);
}

[spring] Spring Security redirect to previous page after successful login

The answer is

Examples related to spring

Examples related to redirect

Examples related to spring-security

Tags