Home/ Questions/Q 4332236
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-21T10:13:39+00:00

How to proceed if I want to check if credentials are valid ? For

  • 0

How to proceed if I want to check if credentials are valid ?

For example, I want to be sure that username is valid (valid email, limited size and so on) so I can display the error to the user before even attempting to authenticate using Spring Security.

1) Make sure credentials are valid before authentication
2) Authenticate
3) Rock-n-roll

Btw, I’m using Spring Security 3.1.0 RC.

Thank you in advance for your help,
Adnan

Update:
Actually I’m talking about validation: making sure that username is in valid email format, or make sure that the passwords is at least 8 characters and so on.
Only when I’m sure that it is in “valid” format I will submit it to the Security authentication & authorization else I just want to display the login form again with error message (for example: “password must be at least 8 characters”).

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You may want to skip validation on login and only do validation on registration/edit profile/change password. When they attempt to login with a bad username/password it just won’t be found.

    I can see two ways to do what you want. Normally the login page POSTs to /j_spring_security_check with j_username and j_password. The UsernamePasswordAuthenticationFilter intercepts this POST and delegates to the AuthenticationManager and its AuthenticationProviders (usually the DaoAuthenticationProvider).

    If you really want to do validation before it hits any Spring Security code you will need to add a Filter before the UsernamePasswordAuthenticationFilter and do your validation there.

    Alternatively, subclass DaoAuthenticationProvider and override retreiveUser(). In retrieveUser() do your extra validation, throwing an exception if the validation fails.

    Configure your subclass as the authentication provider like so:

    <authentication-manager>
  <authentication-provider ref='myAuthenticationProvider'/>
</authentication-manager>
    • 0