Why my customized filter can not be executed?

Question

I want to do something in my customized filter before the LoginController. However the log of execution is only login. Why the result is not filter + login? Many thanks!

The log will show when I type http://localhost:8080/ContextRoot/login

web.xml

...
<filter>
    <filter-name>SessionExpiredFilter</filter-name>
    <filter-class>com.test.filter.SessionExpiredFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>SessionExpiredFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
...

<security-constraint>
    <web-resource-collection>
        <web-resource-name>all resources</web-resource-name>
        <description>all resources</description>
        <url-pattern>/login</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
        <http-method>HEAD</http-method>
    </web-resource-collection>
    <auth-constraint>
        <description>Constraint</description>
        <role-name>user</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>

<login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
        <form-login-page>/login</form-login-page>
        <form-error-page>/login?=error</form-error-page>
    </form-login-config>
</login-config>

LoginController.java

@RequestMapping(value = "/login")
public String login(HttpSession session) {
    log.info("login");
    if (session.getAttribute("login") != null) {
        log.info("login already , redirect to index");
        return "index";
    }
    return "login";
}

SessionExpiredFilter.java

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    log.info("filter");
    HttpServletRequest req = (HttpServletRequest) request;
    HttpServletResponse res = (HttpServletResponse) response;
    if ("true".equals(req.getAttribute("login"))) {
        chain.doFilter(request, response);
    } else {
        res.sendRedirect("login");
    }
}

I am unsure because I never use container security (I prefere spring-security), but I suppose it could be related to the fact that `/login` has a security constraint for `role = user`, and is also the `form-login-page` so I do not know how the container hits the controller. Is your filter correctly called on other pages ? — Serge Ballesta, Oct 04 '14 at 13:38
http://stackoverflow.com/questions/10356361/filtering-requests-involving-security-constraints — sodik, Oct 04 '14 at 15:06
You are on the edge of infinite redirects here. Your login page should be plain jsp, and it shouldn't be protected by security constraints to be available by anyone. Container will automatically invoke that page, when you are trying to access protected resource. And then redirect to that resource after successful authentication. — Gas, Oct 04 '14 at 15:20
@sodik thank you for your answer! That is the problem I met! — LoveTW, Oct 07 '14 at 01:31

Why my customized filter can not be executed?

0 Answers0