authentication - Spring security - Restricting Authenticated User redirection to Login -
after login, when login url accessed out logging out, login page shown, not want login page, instead remain on same page when login url accessed address bar.
following security configuration:
<form-login login-page="/loginform.do" authentication-failure-url = "/loginform.do?error=1" default-target-url="/dashboard.do" always-use-default- target="false" />
one solution come across redirect page, if role not 'role_anonymous'
<sec:authorize ifnotgranted="role_anonymous"> <% response.sendredirect("/mainpage.jsp"); %> </sec:authorize>
but can similar configuration done in security configuration file ?
i solved handlerinterceptor
because dont know build in solution.
import org.springframework.web.util.urlpathhelper; ... public class preventloginpageforloggedinuserinterceptor extends handlerinterceptoradapter { private urlpathhelper urlpathhelper = new urlpathhelper(); @override public boolean prehandle(httpservletrequest request, httpservletresponse response, object handler) throws exception { if (urlpathhelper.getlookuppathforrequest(request).startswith("/login")) && isauthenticated()) { sendredirect(request, response); return false; } else { return true; } } private void sendredirect(httpservletrequest request, httpservletresponse response) { response.setstatus(httpstatus.temporary_redirect.value()); response.setheader("location", response.encoderedirecturl(request.getcontextpath() + "/")); } private boolean isauthenticated() { authentication authentication = securitycontextholder.getcontext().getauthentication(); return (authentication != null) && (!authentication instanceof anonymousauthenticationtoken) && authentication.isauthenticated() } }
Comments
Post a Comment