Question

we’re using Spring MVC with Spring security. One of the requirements is that if an user tries to access a page and they’re not login yet, the app should redirect them to a login page then forward them to the requested page. our app does not use session. I’ve done these kind of thing before and it was pretty straight forward with session and non-Spring but not sure how it is done in Spring security. Would like to get some pointers here. thx

Answer 1

Spring Security in a web context will, by default, use the session. You don’t need to do anything special for it to happen. You can set it up to work without using the session, but it is not trivial and likely to cause more problems.

By default, the behavior you describe is how Spring Security will work:

1 – Request page
1a – If session has permission to see the page, allow request through
1b – If session doesn’t have permission to see the page, redirect to login screen
2 – Submit login form
2a – If login successful, redirect to originally requested page
2b – If login not successful, return error message on login screen

I would suggest going through the user guide tutorials on the Spring Security website and go from there. If you run into trouble, please post another question here with what you’ve tried and what isn’t working, but please do try a bit on your own first. You will get much farther than you think.