Spring Boot+Spring Security自定义登录页与控制器问题排查

Hey there, let's dig into why your login form keeps redirecting back to login.html even after submitting to /loginSecure. I've dealt with similar issues before, so here are the key things to check step by step:

1. Verify Form Submission Basics #

First, make sure your login form is set up correctly—small mistakes here are a common culprit:

• Ensure the form uses method="POST" (Spring Security only accepts POST requests for login processing by default; GET requests will trigger an immediate redirect).
• Double-check that your username/password input fields have the correct name attributes. By default, Spring Security expects username and password—if you've customized these in your Security config (e.g., usernameParameter("email")), your form inputs must match that exact name.
• Confirm the form's action is exactly /loginSecure (no typos, case mismatches can cause issues depending on your server setup).

2. Validate Your Security Configuration #

Your SecurityConfiguration needs to properly wire up the custom login flow. Here's a corrected, complete example to cross-reference:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable() // You mentioned this, good—just ensure it's placed correctly
            .authorizeRequests()
                // Allow unauthenticated access to login page and related resources
                .antMatchers("/login.html", "/css/**", "/js/**").permitAll()
                // Require auth for all other requests
                .anyRequest().authenticated()
            .and()
            .formLogin()
                .loginPage("/login.html") // Tell Security to use your custom login page
                .loginProcessingUrl("/loginSecure") // The URL that handles form submissions
                .defaultSuccessUrl("/dashboard", true) // Force redirect to dashboard after success (no fallback to previous request)
                .failureUrl("/login.html?error=true"); // Redirect back with error flag on failure
    }
}

Critical checks here:

• Make sure /login.html and /loginSecure are both permitted for anonymous users (via permitAll()). If not, unauthenticated requests to these URLs will loop back to the login page.
• The loginProcessingUrl must be declared within the formLogin() chain—this tells Spring Security to intercept POST requests to that URL for authentication.

3. Check Your Custom Controller (Common Pitfall!) #

Do NOT create a @PostMapping("/loginSecure") in your custom controller. The loginProcessingUrl configuration tells Spring Security's filter chain to handle this endpoint directly. If you've written your own POST handler for /loginSecure, it will conflict with Security's authentication flow, causing unexpected redirects.

Your controller only needs a GET mapping to serve the login page:

@Controller
public class LoginController {

    @GetMapping("/login.html")
    public String showLoginPage() {
        return "login"; // Assumes your login.html is in the templates folder (Thymeleaf/FreeMarker)
    }
}

4. Debug Authentication Failures #

To figure out why the redirect is happening, add visibility into failed attempts:

• Use the failureUrl with an error parameter (like /login.html?error=true) as shown above. Then, in your login.html, you can display a user-friendly message:

  <div th:if="${param.error}" class="alert alert-danger">
      Invalid username or password!
  </div>
  

• Add a custom failure handler to log the exact error reason:

  http.formLogin()
      .failureHandler((request, response, exception) -> {
          // Log the root cause of the failure
          System.err.println("Login failed: " + exception.getMessage());
          response.sendRedirect("/login.html?error=true");
      });
  

Common failure reasons include: incorrect credentials, locked user accounts, or mismatched parameter names between the form and Security config.

5. Inspect the Request in Chrome DevTools #

Head to the Network tab in DevTools and watch the /loginSecure request:

• Confirm the request method is POST, and check the Form Data to ensure username/password are being sent correctly.
• Look at the response status code—if it's a 3xx redirect, check where it's sending you. If it's redirecting to /login.html without the error parameter, it might be an issue with anonymous access permissions rather than authentication failure.

内容的提问来源于stack exchange，提问作者pronane