Spring Security Tutorial does not work with Tomcat Server

Question

I did this tutorial https://spring.io/guides/gs/securing-web/ which uses SpringBoot and SpringSecurity for a WebApplication. As it is described in the tutorial the whole project is executed via the main-class and configured with auto-configuration.

My goal is to use the same thing running on a Tomcat Server (I'm using IntelliJ IDEA). Everything is executed without any errors but somehow I am not redirected to the login-page if I go to the "hello"-page. Instead it shows me Hello null!. In the debug log I can see the following:

10:34:06.102 [http-apr-8080-exec-5] DEBUG o.s.web.servlet.DispatcherServlet - DispatcherServlet with name 'dispatcher' processing GET request for [/hello]
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.w.s.h.SimpleUrlHandlerMapping - Mapping [/hello] to HandlerExecutionChain with handler [org.springframework.web.servlet.mvc.ParameterizableViewController@225a46d1] and 1 interceptor
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.web.servlet.DispatcherServlet - Last-Modified value for [/hello] is: -1
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.w.s.v.ContentNegotiatingViewResolver - Requested media types are [text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8] based on Accept header types and producible media types [*/*])
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.w.s.view.BeanNameViewResolver - No matching bean found for view name 'hello'
10:34:06.103 [http-apr-8080-exec-5] DEBUG o.s.w.s.v.ContentNegotiatingViewResolver - Returning [org.thymeleaf.spring4.view.ThymeleafView@2c9dacea] based on requested media type 'text/html'
10:34:06.104 [http-apr-8080-exec-5] DEBUG o.s.web.servlet.DispatcherServlet - Rendering view [org.thymeleaf.spring4.view.ThymeleafView@2c9dacea] in DispatcherServlet with name 'dispatcher'
10:34:06.104 [http-apr-8080-exec-5] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'requestDataValueProcessor'
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine - [THYMELEAF][http-apr-8080-exec-5] STARTING PROCESS OF TEMPLATE "hello" WITH LOCALE de
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine - [THYMELEAF][http-apr-8080-exec-5] Starting process on template "hello" using mode "HTML5"
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine - [THYMELEAF][http-apr-8080-exec-5] Finished process on template "hello" using mode "HTML5"
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine - [THYMELEAF][http-apr-8080-exec-5] FINISHED PROCESS AND OUTPUT OF TEMPLATE "hello" WITH LOCALE de
10:34:06.104 [http-apr-8080-exec-5] DEBUG org.thymeleaf.TemplateEngine.TIMER - [THYMELEAF][http-apr-8080-exec-5][hello][de][644609][1] TEMPLATE "hello" WITH LOCALE de PROCESSED IN 644609 nanoseconds (approx. 1ms)
10:34:06.104 [http-apr-8080-exec-5] DEBUG o.s.web.servlet.DispatcherServlet - Successfully completed request

I want to have a pure java-based config and set it up according to the Spring Docs.

My AppConfig looks like this:

@EnableAutoConfiguration //do magic
@Configuration
@ComponentScan("de.visargue")
@Import({MvcConfig.class, SecurityConfig.class})
public class AppConfig {

    public static void main(String[] args) throws Throwable {
        SpringApplication.run(AppConfig.class, args);
    }
}

The SecurityConfig looks as it is in the tutorial. By debugging I can see that those methods are executed when the war is deployed. However, the redirect to the login page does not work anymore.

By clicking on logout the output shows me that no handler can be found.

10:42:07.653 [http-apr-8080-exec-7] DEBUG o.s.web.servlet.DispatcherServlet - DispatcherServlet with name 'dispatcher' processing POST request for [/logout]
10:42:07.653 [http-apr-8080-exec-7] DEBUG o.s.w.s.m.m.a.RequestMappingHandlerMapping - Looking up handler method for path /logout
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.m.m.a.RequestMappingHandlerMapping - Did not find handler method for [/logout]
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.h.SimpleUrlHandlerMapping - Matching patterns for request [/logout] are [/**]
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.h.SimpleUrlHandlerMapping - URI Template variables for request [/logout] are {}
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.h.SimpleUrlHandlerMapping - Mapping [/logout] to HandlerExecutionChain with handler [org.springframework.web.servlet.resource.ResourceHttpRequestHandler@45dfaa56] and 1 interceptor
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.m.a.ResponseStatusExceptionResolver - Resolving exception from handler [org.springframework.web.servlet.resource.ResourceHttpRequestHandler@45dfaa56]: org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.w.s.m.s.DefaultHandlerExceptionResolver - Resolving exception from handler [org.springframework.web.servlet.resource.ResourceHttpRequestHandler@45dfaa56]: org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
10:42:07.654 [http-apr-8080-exec-7] WARN  o.s.web.servlet.PageNotFound - Request method 'POST' not supported
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.web.servlet.DispatcherServlet - Null ModelAndView returned to DispatcherServlet with name 'dispatcher': assuming HandlerAdapter completed request handling
10:42:07.654 [http-apr-8080-exec-7] DEBUG o.s.web.servlet.DispatcherServlet - Successfully completed request

Can someone explain me why the whole setup is working when I start the project via the main-method but not when it is deployed as a war on the tomcat server?

Answer 1

I just found the solution. For the WAR you need to add another class. I added mine into my config-package where the other configuration classes are.

import org.springframework.security.web.context.*;

public class MessageSecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
}

This is all you need to make it work.

In this tutorial it is described: http://docs.spring.io/autorepo/docs/spring-security/3.2.x/guides/hellomvc.html#registering-spring-security-with-the-war