Question

Earlier I asked if it was possible to get the original request url in the form login page in Spring Security 2. Turns out that actually won’t help me, what I need is for the redirect to the form-login page to have that embedded in it as a request parameter. So if I have:

<form-login login-page="/login.html" /> 

and try to access /secure.html I want to end up in /login.html?return_to=/secure.html.

Answer 1

The redirect to the login form is performed by the AuthenticationEntryPoint. For Spring Security 3.0+ this will usually be an instance of LoginUrlAuthenticationEntryPoint. In 2.0 the corresponding class is AuthenticationProcessingFilterEntryPoint.

The entry point is invoked by the ExceptionTranslationFilter which is also responsible for caching the request. You can therefore write a custom AuthenticationEntryPoint which redirects to the login page URL with the additional parameter appended (containing the current request URI). The code should be almost identical to the standard implementation.

You can inject a custom AuthenticationEntryPoint into the namespace configuration using the entry-point-ref attribute on the http namespace element. If you are using plain beans, you would inject it into the ExceptionTranslationFilter.