SyntaxFix

[java] Two Page Login with Spring Security 3.2.x

There should be three pages here:

  1. Initial login page with a form that asks for your username, but not your password.
  2. You didn't mention this one, but I'd check whether the client computer is recognized, and if not, then challenge the user with either a CAPTCHA or else a security question. Otherwise the phishing site can simply use the tendered username to query the real site for the security image, which defeats the purpose of having a security image. (A security question is probably better here since with a CAPTCHA the attacker could have humans sitting there answering the CAPTCHAs to get at the security images. Depends how paranoid you want to be.)
  3. A page after that that displays the security image and asks for the password.

I don't see this short, linear flow being sufficiently complex to warrant using Spring Web Flow.

I would just use straight Spring Web MVC for steps 1 and 2. I wouldn't use Spring Security for the initial login form, because Spring Security's login form expects a password and a login processing URL. Similarly, Spring Security doesn't provide special support for CAPTCHAs or security questions, so you can just use Spring Web MVC once again.

You can handle step 3 using Spring Security, since now you have a username and a password. The form login page should display the security image, and it should include the user-provided username as a hidden form field to make Spring Security happy when the user submits the login form. The only way to get to step 3 is to have a successful POST submission on step 1 (and 2 if applicable).

Examples related to java

• Under what circumstances can I call findViewById with an Options Menu / Action Bar item? • How much should a function trust another function • How to implement a simple scenario the OO way • Two constructors • How do I get some variable from another class in Java? • this in equals method • How to split a string in two and store it in a field • How to do perspective fixing? • String index out of range: 4 • My eclipse won't open, i download the bundle pack it keeps saying error log

Examples related to spring

• Are all Spring Framework Java Configuration injection examples buggy? • Two Page Login with Spring Security 3.2.x • Access blocked by CORS policy: Response to preflight request doesn't pass access control check • Failed to configure a DataSource: 'url' attribute is not specified and no embedded datasource could be configured • ApplicationContextException: Unable to start ServletWebServerApplicationContext due to missing ServletWebServerFactory bean • Failed to auto-configure a DataSource: 'spring.datasource.url' is not specified • Spring Data JPA findOne() change to Optional how to use this? • After Spring Boot 2.0 migration: jdbcUrl is required with driverClassName • The type WebMvcConfigurerAdapter is deprecated • No converter found capable of converting from type to type

Examples related to security

• Monitoring the Full Disclosure mailinglist • Two Page Login with Spring Security 3.2.x • How to prevent a browser from storing passwords • JWT authentication for ASP.NET Web API • How to use a client certificate to authenticate and authorize in a Web API • Disable-web-security in Chrome 48+ • When you use 'badidea' or 'thisisunsafe' to bypass a Chrome certificate/HSTS error, does it only apply for the current site? • How does Content Security Policy (CSP) work? • How to prevent Screen Capture in Android • Default SecurityProtocol in .NET 4.5

Examples related to spring-mvc

• Two Page Login with Spring Security 3.2.x • ApplicationContextException: Unable to start ServletWebServerApplicationContext due to missing ServletWebServerFactory bean • Spring 5.0.3 RequestRejectedException: The request was rejected because the URL was not normalized • The type WebMvcConfigurerAdapter is deprecated • RestClientException: Could not extract response. no suitable HttpMessageConverter found • Spring boot: Unable to start embedded Tomcat servlet container • UnsatisfiedDependencyException: Error creating bean with name • 8080 port already taken issue when trying to redeploy project from Spring Tool Suite IDE • Error creating bean with name 'entityManagerFactory' defined in class path resource : Invocation of init method failed • Difference between the annotations @GetMapping and @RequestMapping(method = RequestMethod.GET)

Examples related to spring-security

• Two Page Login with Spring Security 3.2.x • Spring 5.0.3 RequestRejectedException: The request was rejected because the URL was not normalized • Unsupported Media Type in postman • How Spring Security Filter Chain works • Spring security CORS Filter • How to configure CORS in a Spring Boot + Spring Security application? • Failed to load ApplicationContext (with annotation) • disabling spring security in spring boot app • When to use Spring Security`s antMatcher()? • How to manage exceptions thrown in filters in Spring?