This webpage has a redirect loop in spring-security application

java, spring, spring-mvc, spring-security

Solution

I believe the order of `intercept-url` is important here, and it seems like your `/**` pattern is swallowing `/login` and `/resources` too.

Try this:-

<http pattern="/resources/**" security="none"/>
<http pattern="/login" security="none"/>

<http use-expressions="true">
    <form-login login-processing-url="/resources/j_spring_security_check"
        login-page="/login" authentication-failure-url="/login?login_error=t" />
    <logout logout-url="/resources/j_spring_security_logout" />
    <intercept-url pattern="/**" access="isAuthenticated()" />
</http>

This configuration is very similar to one of my existing projects.

UPDATE

This is the configuration I'm currently using in my project:-

<security:http pattern="/resources/**" security="none"/>
<security:http pattern="/login" security="none"/>
<security:http pattern="/error/**" security="none"/>

<security:http auto-config="true">
    <security:form-login login-page="/login"
                         authentication-failure-url="/login?login_error=1"
                         default-target-url="/"
                         always-use-default-target="true"/>
    <security:logout logout-success-url="/"/>
    <security:intercept-url pattern="/**" access="ROLE_USER"/>
</security:http>

03-19-13

In order to use `security` attribute in `http` tag, you will need Spring Security 3.1... see http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#new-3.1-ns

Problem

i have a web application in spring which uses spring security, when i try to excute the application it says ``` This webpage has a redirect loop ``` this is my `security-context.xml` after adding this only i get this exception ``` <?xml version="1.0" encoding="UTF-8"?> <b:beans xmlns="http://www.springframework.org/schema/security" xmlns:b="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> <!-- HTTP security configurations --> <http use-expressions="true"> <form-login login-processing-url="/resources/j_spring_security_check" login-page="/login" authentication-failure-url="/login?login_error=t" /> <logout logout-url="/resources/j_spring_security_logout" /> <intercept-url pattern="/**" access="isAuthenticated()" /> <intercept-url pattern="/login*" access="permitAll()" /> <intercept-url pattern="/resources/**" access="permitAll()" /> </http> <!-- Configure Authentication mechanism --> <authentication-manager alias="authenticationManager"> <authentication-provider> <user-service> <user name="admin" password="admin" authorities="RIGHT_LIST,RIGHT_CANCEL,RIGHT_CREATE,RIGHT_UPDATE" /> <user name="antony" password="antony" authorities="RIGHT_LIST,RIGHT_CANCEL,RIGHT_CREATE,RIGHT_UPDATE" /> <user name="rod" password="rod" authorities="RIGHT_LIST,RIGHT_CREATE"/> </user-service> </authentication-provider> </authentication-manager> <global-method-security secured-annotations="enabled" pre-post-annotations="enabled"> <expression-handler ref="expHandler"/> </global-method-security> <b:bean id="expHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"> <b:property name="permissionEvaluator"> <b:bean class="com.anto.springsec.security.CreateContactPermissionEvaluator"/> </b:property> </b:bean> </b:beans> ``` i have one login.jsp and one more createContact.jsp this is my home controler : ``` package com.anto.springsec.controllers; import java.text.DateFormat; import java.util.Date; import java.util.Locale; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; /** * Handles requests for the application home page. */ @Controller public class HomeController { private static final Logger logger = LoggerFactory.getLogger(HomeController.class); /** * Simply selects the home view to render by returning its name. */ @RequestMapping(value = "/login", method = RequestMethod.GET) public String home(Locale locale, Model model) { logger.info("Welcome home! The client locale is {}.", locale); Date date = new Date(); DateFormat dateFormat = DateFormat.getDateTimeInstance(DateFormat.LONG, DateFormat.LONG, locale); String formattedDate = dateFormat.format(date); model.addAttribute("serverTime", formattedDate ); return "login"; } } ``` please help me to resolve this.

Original source