Question

I’ve tried to debug this without any success. I have a working Spring Application with GWT and Spring Security, but when I change the security-context around to use CAS authentication, I do get redirected to the cas page (usually), but after successful login, I get redirected to the correct url, but I get a “page not found error” at the browser level. After refreshing the page (same url), I’m logged in, and application loads as expected. No errors in the logs, as far as I can tell, no differences in what’s happening in the application when using CAS vs normal spring security form login.

Answer 1

I believe this answered my question:

http://static.springsource.org/spring-security/site/faq/faq.html#faq-cached-secure-page

which basically states that if you’re securing html pages, you’re in charge of configuring caching, so that a cached page can’t be accessed. In my case, this wasn’t entirely clear, as the gwt services were still getting secured, so I wasn’t seeing secured content, but still, that was the problem-