What would be the most elegant way of implementing a force password change upon user's initial login using Spring Security?
I tried implementing a custom AuthenticationSuccessHandler
as mentioned here, but as mentioned by rodrigoap, if a user manually inputs the URL at the address bar, the user will still be able to proceed to that page even if he didn't change his password.
I did this with a filter ForceChangePasswordFilter. Because if the user types the url by hand they can bypass the change password form. With the filter the request always get intercepted.
As such, I proceeded with implementing a custom filter.
My question is this, when I implement a custom filter and send a redirect inside it, it goes through the filter again causing an infinite redirect loop as mentioned here.
I tried implementing the solution mentioned by declaring two http tags in my security-context.xml with the first tag having the pattern
attribute as such but it still goes through my custom filter:
<http pattern="/resources" security="none"/>
<http use-expressions="true" once-per-request="false"
auto-config="true">
<intercept-url pattern="/soapServices/**" access="permitAll" requires-channel="https"/>
...
<custom-filter position="LAST" ref="passwordChangeFilter" />
</http>
...
<beans:bean id="passwordChangeFilter"
class="my.package.ForcePasswordChangeFilter"/>
<beans:bean id="customAuthenticationSuccessHandler"
class="my.package.CustomAuthenticationSuccessHandler" >
</beans:bean>
<beans:bean id="customAuthenticationFailureHandler"
class="my.package.CustomAuthenticationFailureHandler" >
<beans:property name="defaultFailureUrl" value="/login"/>
</beans:bean>
What my current implementation is (which works) is:
- Inside my custom authentication success handler, I set a session attribute
isFirstLogin
- In my ForcePasswordChangeFilter, I check if the session
isFirstLogin
is set- If it is, then I send a redirect to my force password change
- Else, I call
chain.doFilter()
My problem with this implementation is that access to my resources folder also goes through this filter which causes my page to be distorted (because *.js and *.css are not successfully retrieved).
This is the reason I tried having two <http>
tags in my security app context.xml (which didn't work).
As such, I ended up having to manually filter the request if the servletPath starts or contains "/resources". I didn't want it to be like this - having to manually filter the request path - but for now it's what I have.
What's the more elegant way of doing this?