Spring Security自定义登录页面不起作用

Question

I am making enterprise webapp, i have built my custom login page but somehow only spring security login page is coming instead of my custom login page. Below is my security configuration class.

please help.

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

@Autowired
public void configureGlobalSecurity(AuthenticationManagerBuilder auth)
        throws Exception {
    auth.inMemoryAuthentication().withUser("test").password("pwd123")
            .roles("USER", "ADMIN");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .antMatchers("/login").permitAll()
            .antMatchers("/", "/*todo*/**").access("hasRole('USER')").and()
            .formLogin();
        http.csrf().disable();
}

Answer 1

You have to specify the url to your custom login page.

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
        .antMatchers("/login").permitAll()
        .antMatchers("/", "/*todo*/**").access("hasRole('USER')").and()
        .formLogin()

         // put the relative URL to your custom login here
             .loginPage("/login")
             .permitAll();
    http.csrf().disable();
}

Hope this helps.

Answer 2

Look every thing good, this is work for me:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
         .authorizeRequests()
             .antMatchers("/todo/**").hasRole("USER")
             .antMatchers("/", "/home").permitAll()
             .antMatchers("/login").permitAll()
             .anyRequest().authenticated()
             .and()
        .formLogin()
             .loginPage("/login")
             .defaultSuccessUrl("/home")
             .permitAll()
             .and()
         .logout() 
             .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
             .logoutSuccessUrl("/home")
             .permitAll()
             .and()
         .exceptionHandling().accessDeniedPage("/403");
  }

Here is a Spring Boot project.

Answer 3

@Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable(); http.authorizeRequests().antMatchers("/login").permitAll() .anyRequest().authenticated().and() .formLogin() .loginPage("/login") .defaultSuccessUrl("/home") .failureUrl("/login?error=true") .permitAll() .and() .logout() .logoutSuccessUrl("/login?logout=true") .invalidateHttpSession(true) .deleteCookies("JSESSIONID") .permitAll(); }

Reference : https://devkonline.com/tutorials/content/SPRING-SECURITY-5-CUSTOM-FORM-LOGIN-THYMELEAF