5

Possible Duplicate:
create-session stateless usage

Im just beginning experimenting on Spring Security, on version 3.1, and im wondering how to achieve authentication with a stateless webapp.

http-basic and digest come to mind, and i've tried them, but i dislike the inability to logout like the form authentication without closing the browser.

I currently have a working stateless webapp with form-based authentication using spring security (which makes it stateful by storing auth stuffs in session perhaps ?), and i wonder what are the strategies that i could research on to make spring security work without making use of http sessions ?

I realize that there's a <http create-session="stateless" ..>, but there must be something that needs more doing because the app stops working correctly after i tried that, by keep authenticating me when accessing protected resources.

Here's my config :

<http use-expressions="true" create-session="stateless">
    <form-login login-page="/login" 
        login-processing-url="/static/j_spring_security_check"
        authentication-failure-url="/login?login_error=t" />
    <logout logout-url="/static/j_spring_security_logout"/>

    <intercept-url pattern="/person/test/**" 
        access="isAuthenticated() and principal.username=='albertkam'"
    />
    <intercept-url pattern="/person/**" access="hasRole('ROLE_NORMAL')"/>

    <remember-me
        key="spitterKey"
        token-validity-seconds="2419200"/>
</http>

With create-session="stateless" :

  1. accessing http://myhost:8080/mycontext/person/blah
  2. goes to login page
  3. returns to homepage url http://myhost:8080/mycontext after logging in (i expect it returns to the protected resource)

Without create-session="stateless", which defaults to ifRequired (stateful) :

  1. accessing http://myhost:8080/mycontext/person/blah
  2. goes to login page
  3. returns to the protected url http://myhost:8080/mycontext/person/ blah after logging in (this is correct behaviour , but stateful)
Community
  • 1
  • 1
Bertie
  • 17,277
  • 45
  • 129
  • 182
  • 1
    It's been answered in this [topic][1] [1]: http://stackoverflow.com/questions/8800855/create-session-stateless-usage – Bertie Jan 12 '12 at 02:01

1 Answers1

0

You can use always-use-default-target="false" on <form-login>to prevent going to default page after successful login.

kdabir
  • 9,623
  • 3
  • 43
  • 45
  • Hi, i tried your suggestion, but it still goes to the homepage with the stateless. I think it's not the the problem, since without the stateless attribute value, the flow works fine. – Bertie Jan 02 '12 at 14:23
  • Oh am sorry to know that, I thought always-use-default-target="false" should work in case of stateless too. – kdabir Jan 04 '12 at 07:45