java - SpringSecurity localhost redirected too many times - Stack Overflow

admin管理员组

文章数量:1123770

I am studying about Spring Security. I'm doing the authorization and authentication from login page but i always get an error:

"localhost redirected you too many times."

I've tried clearing my cache & cookies in the browser and still get the same error.

This is my security config

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
            .authorizeRequests(auth -> auth
                  .requestMatchers("/admin/**").hasRole("ADMIN")
                  .requestMatchers("/user/**").hasRole("USER")
                  .requestMatchers("/admin/login").permitAll()
                  .anyRequest().authenticated())
            .formLogin(login -> login
                            .loginPage("/admin/login")
                            .successHandler(new AuthenticationHandler())
                            .permitAll()
            )
            .logout(logout -> logout
                  .logoutUrl("/logout")
                  .logoutSuccessUrl("/login?logout").permitAll()
            );
    return http.build();
}

and my success handler

public class AuthenticationHandler implements AuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
        // GET ROLE
        String role = authentication.getAuthorities().iterator().next().getAuthority();
    
        if (role.equals("ROLE_ADMIN")) {
            httpServletResponse.sendRedirect("/admin/home");
        }
        else if (role.equals("ROLE_USER")) {
            httpServletResponse.sendRedirect("/public/home");
        }
        else {
            httpServletResponse.sendRedirect("/login?error=true");
        }
    }

}

I am studying about Spring Security. I'm doing the authorization and authentication from login page but i always get an error:

"localhost redirected you too many times."

I've tried clearing my cache & cookies in the browser and still get the same error.

This is my security config

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
            .authorizeRequests(auth -> auth
                  .requestMatchers("/admin/**").hasRole("ADMIN")
                  .requestMatchers("/user/**").hasRole("USER")
                  .requestMatchers("/admin/login").permitAll()
                  .anyRequest().authenticated())
            .formLogin(login -> login
                            .loginPage("/admin/login")
                            .successHandler(new AuthenticationHandler())
                            .permitAll()
            )
            .logout(logout -> logout
                  .logoutUrl("/logout")
                  .logoutSuccessUrl("/login?logout").permitAll()
            );
    return http.build();
}

and my success handler

public class AuthenticationHandler implements AuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
        // GET ROLE
        String role = authentication.getAuthorities().iterator().next().getAuthority();
    
        if (role.equals("ROLE_ADMIN")) {
            httpServletResponse.sendRedirect("/admin/home");
        }
        else if (role.equals("ROLE_USER")) {
            httpServletResponse.sendRedirect("/public/home");
        }
        else {
            httpServletResponse.sendRedirect("/login?error=true");
        }
    }

}

• java
• spring-security

Share Improve this question Follow edited 19 hours ago ipodtouch0218 3,24199 gold badges1414 silver badges2929 bronze badges asked yesterday Dương NguyễnDương Nguyễn 1 New contributor Dương Nguyễn is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct. 1

• Do you reach the AuthenticationSuccessHandler when you attempt to log in? Which endpoint does it redirect you to when you test? – Bernie Commented yesterday

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

I think your're not hitting the USER/ADMIN role and your redirect seems incorrect. If you're having any role but USER/ADMIN, you redirect to /login (which requires the user to be authenticated) instead of /admin/login, seemingly causing an endless redirection loop.

You should probably change the login page to /login instead of /admin/login because in your code, a simple non-admin user can also login, making /admin/login 'wrong'.

本文标签： javaSpringSecurity localhost redirected too many timesStack Overflow