How to redirect to the homepage if the user accesses the login page after being logged in?

java, spring-security

Solution

I've checked the topic more deeply than last time and found that you have to determine if user is authenticated by yourself in controller. Row Winch (Spring Security dev) says here:

Spring Security is not aware of the internals of your application (i.e. if you want to make your login page flex based upon if the user is logged in or not). To show your home page when the login page is requested and the user is logged in use the `SecurityContextHolder` in the login page (or its controller) and redirect or forward the user to the home page.

So solution would be determining if user requesting `/auth/login` is anonymous or not, something like below.

applicationContext-security.xml:

<http auto-config="true" use-expressions="true"
        access-decision-manager-ref="accessDecisionManager">
    <intercept-url pattern="/auth/login" access="permitAll" />
    <intercept-url pattern="/auth/logout" access="permitAll" />
    <intercept-url pattern="/admin/**" access="ADMINISTRATIVE_ACCESS" />
    <intercept-url pattern="/**" access="XYZ_ACCESS" />

    <form-login login-page="/auth/login"
        authentication-failure-url="/auth/loginFailed"
        authentication-success-handler-ref="authenticationSuccessHandler" />
    <logout logout-url="/auth/logout" logout-success-url="/auth/login" />
</http>

<beans:bean id="defaultTargetUrl" class="java.lang.String">
    <beans:constructor-arg value="/content" />
</beans:bean>

<beans:bean id="authenticationTrustResolver"
        class="org.springframework.security.authentication.AuthenticationTrustResolverImpl" />

<beans:bean id="authenticationSuccessHandler"
        class="com.example.spring.security.MyAuthenticationSuccessHandler">
    <beans:property name="defaultTargetUrl" ref="defaultTargetUrl" />
</beans:bean>

Add to applicationContext.xml bean definition:

<bean id="securityContextAccessor"
    class="com.example.spring.security.SecurityContextAccessorImpl" />

which is class

public final class SecurityContextAccessorImpl
      implements SecurityContextAccessor {

  @Autowired
  private AuthenticationTrustResolver authenticationTrustResolver;

  @Override
  public boolean isCurrentAuthenticationAnonymous() {
    final Authentication authentication =
        SecurityContextHolder.getContext().getAuthentication();
    return authenticationTrustResolver.isAnonymous(authentication);
  }
}

implementing simple interface

public interface SecurityContextAccessor {
  boolean isCurrentAuthenticationAnonymous();
}

(`SecurityContextHolder` accessing code is decoupled from controller, I followed suggestion from this answer, hence `SecurityContextAccessor` interface.)

And last but not least redirect logic in controller:

@Controller
@RequestMapping("/auth")
public class AuthController {
  @Autowired
  SecurityContextAccessor securityContextAccessor;

  @Autowired
  @Qualifier("defaultTargetUrl")
  private String defaultTargetUrl;

  @RequestMapping(value = "/login", method = RequestMethod.GET)
  public String login() {
    if (securityContextAccessor.isCurrentAuthenticationAnonymous()) {
      return "login";
    } else {
      return "redirect:" + defaultTargetUrl;
    }
  }
}

Defining `defaultTargetUrl` String bean seems like a hack, but I don't have better way not to hardcode url... (Actually in our project we use `<util:constant>` with class containing static final String fields.) But it works after all.

Problem

Here is my spring security config: ``` <http pattern="/auth/login" security="none" /> <http pattern="/auth/loginFailed" security="none" /> <http pattern="/resources/**" security="none" /> <http auto-config="true" access-decision-manager-ref="accessDecisionManager"> <intercept-url pattern="/auth/logout" access="permitAll"/> <intercept-url pattern="/admin/**" access="ADMINISTRATIVE_ACCESS"/> <intercept-url pattern="/**" access="XYZ_ACCESS"/> <form-login login-page="/auth/login" authentication-failure-url="/auth/loginFailed" authentication-success-handler-ref="authenticationSuccessHandler" /> <logout logout-url="/auth/logout" logout-success-url="/auth/login" /> </http> ``` The `authenticationSuccessHandler` extends the `SavedRequestAwareAuthenticationSuccessHandler` ensuring that the user is redirected to the page he originally requested. However, since `/auth/login` is marked as `security="none"`, I am unable to successfully redirect the user to the homepage if he accesses the login page after being logged in. I believe this is the right user experience too. I tried the below too but the `Principal` object is always `null`, presumably because of the `security="none"` attribute again. ``` @RequestMapping(value = "/auth/login", method = GET) public String showLoginForm(HttpServletRequest request, Principal principal) { if(principal != null) { return "redirect:/"; } return "login"; } ```

Original source

Related problems