Spring Security-配置HttpSecurity

Question

I'm new to Spring Security, I'm trying to create a login form with Spring Security.

This is the required scenario:

1) users log into the app with username - password (please note that I'm using the default loginpage provided by spring Security) 2) if the login is OK, the user go to eventList.jsp 3) if the login is KO (wrong credentials) an error is shown

My WebSecurityConfigurerAdapter configurations:

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication().withUser("amdin").password("111111").roles("USER");
}

@Override
protected void configure(HttpSecurity http) throws Exception {

    http
            .authorizeRequests()
            .anyRequest().authenticated()
            .and()
            .formLogin().defaultSuccessUrl("/eventList");
}

Error 1: if I insert the right credentials I don't see /eventList, but i receive a 404 (/spring-security-helloworld-annotation/WEB-INF/pages/login.jsp). Why I am not redirect to /eventList? (pheraps because /eventList accept only GET in my RequestMapping annotation?

@RequestMapping(value = {"/eventList"}, method = RequestMethod.GET)

Error 2: if I try to "manually" go to /eventList, by adding "eventList" to the end of the URL in my browser, I can access to the requested page without performing the login operation!!! THe only URL that I want to be accessible without performing the login operation is the login page itself!!!

The line .anyRequest().authenticated() should not allow all this!!!

How could I obtain what I desire?

TY in advance

Answer 1

The correct security chain looks the following:

          http
                .authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .defaultSuccessUrl("/eventList")
                .permitAll()
                .and()
                .logout()
                .permitAll();

you forgot the permitAll() statement as well defining the loginPage() Hope it helps! Drop me a pm if you need further help with it.