Spring Boot Too Many Redirects

Question

I'm developing a simple login Form using a Thymeleaf & Spring Boot. When i try hitting the following URL in Chrome: "http://localhost:8080/login" i get an error saying "ERR_TOO_MANY_REDIRECTS". I've tried clearing my cache & cookies in the browser and still get the same error.

I tried disabling the default security login screen by putting the following property into my application.properties: security.basic.enabled=false

and added the following configuration to my SecurityConfig so any URL except "/login" and "/resources" would get authenticated:

@Configuration 
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired 
    private UserRepository userRepository;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
        .authorizeRequests()
            .antMatchers("/resources/**").permitAll()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login")
            .permitAll()
            .and()
        .logout()
            .permitAll();
    }

My LoginController is strightforward:

@Controller
public class LoginController {

        @RequestMapping(value="/login", method=RequestMethod.GET)
        public String loadForm(Model model) {
            model.addAttribute("user", new User());
            return "redirect:/login";
        }

Anyone have any idea's why this happens?

Answer 1

Your Controller catches and redirects to the same url:

@RequestMapping(value="/login", method=RequestMethod.GET)
    public String loadForm(Model model) {
        model.addAttribute("user", new User());
        return "redirect:/login";
    }

Also, your SecurityConfig defines this:

@Configuration 
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    protected void configure(HttpSecurity http) throws Exception {
    ...
    .loginPage("/login")
}

.loginPage()'s javadoc says this:

login page to redirect to if authentication is required

So, any secured request made or direct access to /login will:

• redirect to /login because of .loginPage("/login") in your SecurityConfig
• which you then catch with @RequestMapping(value="/login"
• then redirect to /login with "redirect:/login"
• then re-catch and redirect at will.