spring-boot form login/logout not working (path not found)

Question

I have the following spring-boot setup with form login and basic auth (which partly works - I can login to basic auth OK and the login form appears). I only created the login form because I could not even get the login to render unless I did that. NOTE: Complete code here if it helps: https://github.com/azeckoski/lti_starter Here is my Application config (the relevant part) ``` @Order(23) // MED @Configuration public static class FormLoginConfigurationAdapter extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.antMatcher("/form").authorizeRequests().anyRequest().authenticated() .and().formLogin().permitAll().loginPage("/form/login").loginProcessingUrl("/form/login") .and().logout().logoutUrl("/form/logout").invalidateHttpSession(true).logoutSuccessUrl("/"); } } @Order(45) // LOW @Configuration public static class BasicAuthConfigurationAdapter extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpS…

Accepted Answer

SOLUTION EXAMPLE

Here's an example which shows how it should be done (including the NoAuthConfigurationAdapter which will allow the security info to be accessed outside the /form path. Order is important.

```
@Order(23) // MED
@Configuration
public static class FormLoginConfigurationAdapter extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/form/**").authorizeRequests().anyRequest().authenticated()
                .and().formLogin().permitAll().loginPage("/form/login").loginProcessingUrl("/form/login")
                .and().logout().logoutUrl("/form/logout").invalidateHttpSession(true).logoutSuccessUrl("/");
    }
}

@Order(67) // LOWEST
@Configuration
public static class NoAuthConfigurationAdapter extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // this ensures security context info (Principal, sec:authorize, etc.) is accessible on all paths
        http.antMatcher("/**").authorizeRequests().anyRequest().permitAll();
    }
}
```

spring-boot form login/logout not working (path not found)

Solution

Problem