当发生超时后调用Servlet方法（控制器）时，Spring Security 3.1重定向到登录不起作用

Question

The problem is similar: Spring Security 3.1 redirect to login doesn't work

I use Spring 3.1 with Spring Mvc and Spring Security.

Here, app-security-config.

<security:http  auto-config="true" use-expressions="true">
    <security:form-login login-page="/login.jsp" 
                    login-processing-url="/j_spring_security_check" 
                    default-target-url="/pages/index.jsp"
                    always-use-default-target="true"
                    authentication-failure-url="/login.jsp?login_error=1"/>
                    <security:access-denied-handler ref="accessDeniedHandler"/>

    <!--  Session Invalida-->
    <security:logout invalidate-session="true" logout-success-url="/login.jsp" delete-cookies="JSESSIONID" />

    <!--  Interceptadores -->
    <!-- security:intercept-url pattern="/expire.jsp*" filters="none"/-->
    <!-- security:intercept-url pattern="/login.jsp*" access="ROLE_ANONYMOUS" requires-channel="https"/-->

    <security:intercept-url pattern="/expire.jsp" access="permitAll" />
    <security:intercept-url pattern="/AccessDenied.jsp*" access="permitAll" />
    <security:intercept-url pattern="/scripts/*" access="permitAll" />
    <security:intercept-url pattern="/styles/*" access="permitAll" />
    <security:intercept-url pattern="/images/*" access="permitAll" />
    <security:intercept-url pattern="/login.jsp" access="permitAll" requires-channel="https"/>
    <security:intercept-url pattern="/pages/**" access="hasAnyRole(${role.autenticated})"  requires-channel="https"/>
    <security:http-basic/>

    <!--  Establece maximas sesiones para un usuarios -->
    <security:session-management session-fixation-protection="none" >
       <security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
    </security:session-management>         

    <!--  Establece maximas sesiones para un usuarios -->
    <!-- security:session-management invalid-session-url="/expire.jsp"  session-fixation-protection="none" >
       <security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" expired-url="/expire.jsp"/>
    </security:session-management-->    

    <!-- security:session-management invalid-session-url="/login.jsp?login_error=2" session-authentication-error-url="/login.jsp?login_error=3" session-fixation-protection="none" >
       <security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" expired-url="/login.jsp?login_error=4"/>
    </security:session-management-->   

    <security:port-mappings>
        <security:port-mapping http='8080' https="8443"/>
    </security:port-mappings>

</security:http>


<beans:bean id="accessDeniedHandler" class="ar.com.firstdata.upploader.web.mvc.controller.AccessDeniedController">
    <beans:property name="accessDeniedUrl" value="/AccessDenied.jsp"> </beans:property>
</beans:bean> 

a web.xml

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:META-INF/spring/*-config.xml</param-value>
</context-param>

<jsp-config>
    <taglib>
        <taglib-uri>sitemesh-page</taglib-uri>
        <taglib-location>/tld/sitemesh-page.tld</taglib-location>
    </taglib>

    <taglib>
        <taglib-uri>sitemesh-decorator</taglib-uri>
        <taglib-location>/tld/sitemesh-decorator.tld</taglib-location>
    </taglib>

    <taglib>
        <taglib-uri>/spring</taglib-uri>
        <taglib-location>/META-INF/spring.tld</taglib-location>
    </taglib>
</jsp-config>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>FORWARD</dispatcher>
</filter-mapping>

<listener>
    <listener-class>
        org.springframework.web.context.ContextLoaderListener
    </listener-class>
</listener>

<!-- SiteMesh -->
<filter>
    <filter-name>sitemesh</filter-name>
    <filter-class>com.opensymphony.sitemesh.webapp.SiteMeshFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>sitemesh</filter-name>
    <url-pattern>*.html</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>sitemesh</filter-name>
    <url-pattern>*.htm</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>sitemesh</filter-name>
    <url-pattern>*.jsp</url-pattern>
</filter-mapping>

<listener>
    <listener-class>
        org.springframework.security.web.session.HttpSessionEventPublisher
    </listener-class>
</listener>

<servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>
        org.springframework.web.servlet.DispatcherServlet
    </servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

<session-config>
    <session-timeout>1</session-timeout>
</session-config>

<servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>*.app</url-pattern>
</servlet-mapping>

<welcome-file-list>
    <welcome-file>login.jsp</welcome-file>
</welcome-file-list>

The problen only occurs when try to access some action ending calling a controller method:

<bean id="urlMapping" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
    <property name="mappings">
        <props>
            <prop key="/pages/findConfData.app">configurationController</prop>
            <prop key="/pages/readLoadXML.app">configurationController</prop>
            <prop key="/pages/addElementToList.app">configurationController</prop>
            <prop key="/pages/eraseElementToList.app">configurationController</prop>
            <prop key="/pages/persistXMLfiletransfer.app">configurationController</prop>
            <prop key="/pages/findLoggedUser.app">configurationController</prop>
        </props>            
    </property>
</bean>

and as I say, the the behavior is similar to that disclosed by @spauny, in the log appears: "Access is denied (user is anonymous); redirecting to authentication entry point", after the AccessDeniedException and nothing happens,...

This is te situation: if I spend the time set out in web.xml

<session-config>
    <session-timeout>1</session-timeout>
</session-config>

and I invoke a page restricted (under "/pages/**") redirects me to login page well... BUT when a try to invoke some action which ends up calling a controller method -suppose delete a row in a list-

<prop key="/pages/eraseElementToList.app">configurationController</prop>

@RequestMapping(method = RequestMethod.POST)
public final ModelAndView eraseElementToList(HttpServletRequest request,    
HttpServletResponse response) throws Exception {

I just get an ActionDenied Exception in log and that's it... no redirects me to a login page.

Update 1 04/25 19:43:27 DEBUG hannel.ChannelProcessingFilter - Request: FilterInvocation: URL: /pages/persistXMLfiletransfer.app; ConfigAttributes: [REQUIRES_SECURE_CHANNEL] 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 2 of 12 in additional filter chain; firing Filter: 'ConcurrentSessionFilter' 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 3 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 04/25 19:43:27 DEBUG ssionSecurityContextRepository - HttpSession returned null object for SPRING_SECURITY_CONTEXT 04/25 19:43:27 DEBUG ssionSecurityContextRepository - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@521f809b. A new one will be created. 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 4 of 12 in additional filter chain; firing Filter: 'LogoutFilter' 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 5 of 12 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter' 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 6 of 12 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 7 of 12 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' 04/25 19:43:27 DEBUG vedrequest.DefaultSavedRequest - pathInfo: both null (property equals) 04/25 19:43:27 DEBUG vedrequest.DefaultSavedRequest - queryString: both null (property equals) 04/25 19:43:27 DEBUG vedrequest.DefaultSavedRequest - requestURI: arg1=/UppAudioFilesWebApp/pages/persistXMLfiletransfer.app; arg2=/UppAudioFilesWebApp/pages/persistXMLfiletransfer.app (property equals) 04/25 19:43:27 DEBUG vedrequest.DefaultSavedRequest - serverPort: arg1=8443; arg2=8443 (property equals) 04/25 19:43:27 DEBUG vedrequest.DefaultSavedRequest - requestURL: arg1=/UppAudioFilesWebApp/pages/persistXMLfiletransfer.app; arg2=/UppAudioFilesWebApp/pages/persistXMLfiletransfer.app (property equals) 04/25 19:43:27 DEBUG vedrequest.DefaultSavedRequest - scheme: arg1=https; arg2=https (property equals) 04/25 19:43:27 DEBUG vedrequest.DefaultSavedRequest - serverName: arg1=localhst; arg2=localhst (property equals) 04/25 19:43:27 DEBUG vedrequest.DefaultSavedRequest - contextPath: arg1=/UppAudioFilesWebApp; arg2=/UppAudioFilesWebApp (property equals) 04/25 19:43:27 DEBUG vedrequest.DefaultSavedRequest - servletPath: arg1=/pages/persistXMLfiletransfer.app; arg2=/pages/persistXMLfiletransfer.app (property equals) 04/25 19:43:27 DEBUG equest.HttpSessionRequestCache - Removing DefaultSavedRequest from session if present 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 8 of 12 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 9 of 12 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' 04/25 19:43:27 DEBUG .AnonymousAuthenticationFilter - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 63C5BB1C1CD8981AAF23D71C5521FB9B; Granted Authorities: ROLE_ANONYMOUS' 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 10 of 12 in additional filter chain; firing Filter: 'SessionManagementFilter' 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 11 of 12 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' 04/25 19:43:27 DEBUG .security.web.FilterChainProxy - /pages/persistXMLfiletransfer.app at position 12 of 12 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' 04/25 19:43:27 DEBUG web.util.AntPathRequestMatcher - Checking match of request : '/pages/persistxmlfiletransfer.app'; against '/expire.jsp' 04/25 19:43:27 DEBUG web.util.AntPathRequestMatcher - Checking match of request : '/pages/persistxmlfiletransfer.app'; against '/accessdenied.jsp*' 04/25 19:43:27 DEBUG web.util.AntPathRequestMatcher - Checking match of request : '/pages/persistxmlfiletransfer.app'; against '/scripts/ ' 04/25 19:43:27 DEBUG web.util.AntPathRequestMatcher - Checking match of request : '/pages/persistxmlfiletransfer.app'; against '/styles/ ' 04/25 19:43:27 DEBUG web.util.AntPathRequestMatcher - Checking match of request : '/pages/persistxmlfiletransfer.app'; against '/images/*' 04/25 19:43:27 DEBUG web.util.AntPathRequestMatcher - Checking match of request : '/pages/persistxmlfiletransfer.app'; against '/login.jsp' 04/25 19:43:27 DEBUG web.util.AntPathRequestMatcher - Checking match of request : '/pages/persistxmlfiletransfer.app'; against '/pages/**' 04/25 19:43:27 DEBUG cept.FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /pages/persistXMLfiletransfer.app; Attributes: [hasAnyRole('ROLE_TOMCAT', 'ROLE_ADMNI')] 04/25 19:43:27 DEBUG cept.FilterSecurityInterceptor - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 63C5BB1C1CD8981AAF23D71C5521FB9B; Granted Authorities: ROLE_ANONYMOUS 04/25 19:43:27 DEBUG y.access.vote.AffirmativeBased - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@1304ff98, returned: -1 04/25 19:43:27 DEBUG ess.ExceptionTranslationFilter - Access is denied (user is anonymous); redirecting to authentication entry point org.springframework.security.access.AccessDeniedException: Access is denied at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:83) at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:205) at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:114) at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) at org.springframework.security.web.session.SessionManagementFilter.doFilter(Se ssionManagementFilter.java:101) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)

Answer 1

The most likely explanation here is that you have a Spring ExceptionHandler which is trapping the AccessDeniedException and preventing Spring Security from acting on it. This is quite a common problem if you are using secured annotations somewhere (though you haven't mentioned this anywhere in your question).

Also it should be clear from the stacktrace which mentions the exception that it is not being handled by Spring Security (always post the stacktrace). Also please recheck the log more carefully to differentiate between the two cases. If you see "redirecting to authentication entry point" then that means Spring Security is receiving the exception and you should see the login page. You won't see that if the exception handler is used.

If this is the problem, you can either make your @ExceptionHandler annotations more specific so that they don't trap this exception, or you can create a specific @ExceptionHandler(AccessDeniedException.class) one and simply rethrow the exception in it.