JavaEE - 声明性安全 - 表单登录系统

Question

When I specify a security login system via FORM within web.xml (Tomcat), is there a way to capture an Error or Exception through the informed form-error-page jsp using EL if the authentication isn't succeed?

I'm asking this because I'm wondering to use the same JSP form specified within form-login-page to serve as the form-error-page jsp, thus the JSTL Core c:if would be useful to capture an eventual Exception through ${not empty pageContext.exception}.

Thanks.

Answer 1

Just check if it's forwarding to itself (which thus implies that there's an error) on postback. You can check that by checking if the javax.servlet.forward.request_uri request attribute (which indicates the request URI as the enduser sees in browser's address bar) doesn't end with /j_security_check while HttpServletRequest#getMethod() equals to POST .

<c:if test="${pageContext.request.method == 'POST' && fn:endsWith(requestScope['javax.servlet.forward.request_uri'], '/j_security_check')}">
    <span class="error">Unknown login, please try again.</span>
</c:if>