Spring Security Default Target URL

Just a quick note to self on Spring Security Default Target URLs. In one of my recent projects, I noticed that suddenly my Spring Security based login does not use the specified default target url in the configuration. Instead, it was hitting the root of the application always. This application was working perfectly fine until recently, and default target URL has not been changed since.

The Spring Security definition was:

<security:http auto-config="true">
   <security:intercept-url 
      pattern="/!/signin" 
      access="IS_AUTHENTICATED_ANONYMOUSLY" />
   <security:intercept-url 
      pattern="/!/**" 
      access="ROLE_LOGIN" />
   <security:form-login 
      login-page="/!/signin"
      default-target-url="/!/"
      login-processing-url="/!/authenticate" 
      authentication-failure-url="/!/signin#failed"
      authentication-success-handler-ref="authenticationSuccessHandler" />
   <security:logout logout-url="/!/signout" logout-success-url="/!/signin" />
</security:http>

After debugging through Spring Security code, I noticed that the defaultTargetURL of AbstractAuthenticationTargetUrlRequestHandler is not set to my value, but it uses the default ‘/’. Then after some digging up, it turned out that I’ve added a new Authentication Success Handler to my definition for a different purpose, and when an authentication-success-handler-ref is present in the configuration, the ‘default-target-url’ element in XML configuration is not used.

To fix this, the solution was  to specify the default target URL on my authentication success handler bean as follows.

<bean id="authenticationSuccessHandler" 
   class="com.xyz.PlatformAuthenticationSuccessHandler">
   <property name="defaultTargetUrl" value="/!/" />
</bean>

The reason behind this is, the value we provide on the XML configuration goes to the default authentication success handler only. When we define our own, that value goes no where, so we need to specify it manually on the bean itself. This ate up about 15 mins of my time, before luckily noticing that the success handler change was the reason.