Spring-security shows 'Bad Credentials' even before submitting the form

Question

I have following code for spring security but it does not work. When I open log-in page and enter username/password which is [email protected] / secret, following error message will be shown. Once username/password are entered following with be added to the address ?error=1, even if I remove it manually and refresh the page message does not go. Nothing is shown in console.

Your login attempt was not successful due to

Bad credentials.

spring-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.2.xsd">



    <beans:import resource='login-service.xml' />
    <http auto-config="true" access-denied-page="/notFound.jsp"
        use-expressions="true">
        <intercept-url pattern="/" access="permitAll" />
        <intercept-url pattern="/member**" access="hasRole('ROLE_MEMBER')" />
        <form-login login-page="/signin" default-target-url="/index"
            authentication-failure-url="/signin?error=1" />

        <logout logout-success-url="/login?logout" />
        <csrf />
    </http>
    <authentication-manager>
        <authentication-provider>
            <user-service> <user name="[email protected]" password="secret" 
                authorities="ROLE_ADMIN"/> 
            <user name="[email protected]" password="secret" authorities="ROLE_USER"/> 
                </user-service> 

        </authentication-provider>
    </authentication-manager>
</beans:beans>

The form has following code, it seems like SPRING_SECURITY_LAST_EXCEPTIONis not empty even before submitting the form.

<c:if test="${not empty SPRING_SECURITY_LAST_EXCEPTION}">
            <font color="red"> Your login attempt was not successful due
                to <br />
            <br /> <c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}" />.
            </font>
        </c:if>
            <form id="form-login" role="form" method="post"
                        action="<c:url value='/j_spring_security_check' />"
                        class="relative form form-default">
                        <input type="hidden" name="${_csrf.parameterName}"
                            value="${_csrf.token}" />

I am not sure why, but the same code returns following error now

Your login attempt was not successful due to

Authentication method not supported: GET. 

Answer 1

You need to allow everyone to access your /signin page, even if he is not authenticated.

<intercept-url pattern="/signin" access="permitAll" />

I wrote this answer before the question was changed the first time, at a time where the question was (it is still the title): "Spring-security shows 'Bad Credentials' even before submitting the form"

Answer 2

<intercept-url pattern="/member**" access="hasRole('ROLE_MEMBER')" />


<user name="[email protected]" password="secret" authorities="ROLE_USER"/>

Above configs have two different Role names ROLE_MEMBER and ROLE_USER

UPDATE

Since Authentication method not supported: GET, can you try allowing GET.

<bean id="authenticationFilter" 
      class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"
      p:postOnly="false" />

And the following change is also required in web.xml

<filter-mapping> 
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>FORWARD</dispatcher>
</filter-mapping>

Hope this helps