1

Have such problem: when use spring security 3, try to ask resource (via GET) or commit form (via POST) while should log in. So I redirected to log in form and then spring recover my original request, but it always recovered as GET request (even if I try to make POST request). So I wonder how can I fix it? Or may be how can I allow spring security to store only GET request and skip POST?

I found such code in DefaultSavedRequest:

public boolean doesRequestMatch(HttpServletRequest request, PortResolver portResolver) {

    ...

    if (!"GET".equals(request.getMethod()) && "GET".equals(method)) {
        // A save GET should not match an incoming non-GET method
        return false;
    }

So as I understand, this method compare cache request and incoming request and it shows that requests are not equals only if incoming request is not GET and storing request is GET. So in my case Storing request is POST and incoming is GET, so it return that the are equals, so it work wrong. What can I do with it? Is it bug or there some sense in such specific compare?

UPDATE. I rerun error and see that my primary description was not full. I try to describe it more detailed. I have GET url, that opens form and it commits on the same URL via AJAX as POST with popup message window. I perform GET URL, form opens. Than I logout, and try to commit form. Popup window output error. I log in and redirected to URL (that are the same for GET/POST request), but on screen see not form, but JSON response of my AJAX request and in Firebug I see that after log in performs POST request. When I delete cache filter after login I redirected to the same URL, but it works not as POST request, but as usual GET request and opens form.

1 Answer 1

2

As the manual says, saved-request handling is a "best effort" approach. It can't be all things to all people. It will cache a request (no matter what the request method, GET, POST etc) while it performs a login, and then redirect to the cached URL after login.

The incoming request after the redirect will be a GET (you can't redirect to a POST, for example), so it will do its best to match this against the cached request and decide whether the cached request should be used to replace it, thus carrying on as if the login had never happened.

The code you have posted refers to the case where the user tried to make a GET request and was then prompted to login. If a subsequent request to the same URL is not a GET, it is not the result of the post-login redirect, so the cached request should not be used to replace it.

You can customize the RequestCache using the request-cache namespace element, or replace it with a no-op implementation. If you don't want to use cached requests, you can set the always-use-default-target property of your form-login configuration.

5
  • First of all thanks, for you help! May be I missed something, but in my case how it works? I make POST request, redirected to log in form, logging in, then Spring recover last GET request (all other requests are ignored)? So in my case it just can be that last GET request stored in cache is the same URL as POST request that I performed before logging in? Cause in start (I hoped you follow me in start post) I thought that spring recovers POST request from cache and performed it as GET request.
    – sphinks
    Jan 10, 2013 at 14:43
  • If a request is recovered from the cache, it will have the same method as it did originally. It won't be converted. If you are submitting lots of requests at the same time to the same URL when you're prompted to log in, then things will likely get confused. You need to control that in your app. It's not something that Spring Security can do for you. Again, look at the debug log. It documents how each request is handled in detail. Jan 10, 2013 at 16:43
  • I have change code to make all GET and POST request maps to different path, so it is solve problem, cause in RequestCache config I didn't find anything that helps in my case (as I understand RequestCache config allows to control mapping paths mainly, or I lost something that can be usefull in my case?).
    – sphinks
    Jan 14, 2013 at 13:46
  • RequestCache is an interface, so you can implement it how you want. However, there's nothing in your question which indicates that the default behaviour shouldn't be satisfactory for your requirements. So you should probably do some debugging to work out what is actually cached in the first place and how it is restored. Also make sure you are using the latest version of Spring Security. Jan 14, 2013 at 14:38
  • Please, take a look at start post, I describe error more detailed. If such action of cache is not correct I can provide more information to help fix possible error. Thanks for you help!
    – sphinks
    Jan 15, 2013 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.