Spring Security targetUrlParameter does not redirect

Question

I'm trying to redirect the user back to the page where they clicked the login link. (Pages are read-only for non-authenticated users, but writable for logged in users.) How do I redirect the user back to where they came from after they login?

I'm sending to the user to the login page with this link: /spring_security_login?redirect=/item5. After loging in, I expect the user to be redirected to /item5 page. However, they're always redirected to / page.

Here is the configuration I'm using:

<http use-expressions="true">
    <intercept-url pattern="/**" access="permitAll" />
    <form-login authentication-success-handler-ref="simpleUrlAuthenticationSuccessHandler"/>
</http>
<beans:bean id="simpleUrlAuthenticationSuccessHandler"
    class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
    <beans:property name="defaultTargetUrl" value="/"/>
    <beans:property name="targetUrlParameter" value="redirect"/>
</beans:bean>

It seems that targetUrlParameter is not getting picked up as expected. I'm using Spring Security 3.1.4

Answer 1

The following rules are applied when using the SimpleUrlAuthenticationSuccessHandler:

• If the alwaysUseDefaultTargetUrl property is set to true, the defaultTargetUrl property will be used for the destination.
• If a parameter matching the value of targetUrlParameter has been set on the request, the value will be used as the destination. By default this has the value "spring-security-redirect".
• If the useReferer property is set, the "Referer" HTTP header value will be used, if present.
• As a fallback option, the defaultTargetUrl value will be used.

According to your configuration, this should work. My guess is that you didn't propagate the referer when sending the POST request in the form login. Typically, you should write the referer value in an hidden field in your login page, so that the referer parameter is transmitted to spring_security_login.

Answer 2

Change SimpleUrlAuthenticationSuccessHandler to SavedRequestAwareAuthenticationSuccessHandler and be happy.

Answer 3

it because of this line :

<beans:property name="defaultTargetUrl" value="/"/>

remove that line and try again.

Answer 4

Use SavedRequestAwareAuthenticationSuccessHandler instead of SimpleUrlAuthenticationSuccessHandler.

Even if the url of the page is typed on the browser in which case referer is not captured, SavedRequestAwareAuthenticationSuccessHandler uses the previous url captured by the ExceptionTraslationFilter.

Read http://docs.spring.io/spring-security/site/docs/3.0.x/reference/core-web-filters.html#form-login-flow-handling and http://docs.spring.io/autorepo/docs/spring-security/3.2.4.RELEASE/apidocs/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.html