Spring Security in GWT

Question

I tried spring security with GWT, its redirecting to login perfectly.

I stopped the server and started again and tried to access the URL.

Application doesn't show the login page. It directly going to home page.

Is this how the security works, how to make it work. User name, password and roles are configured in spring configuration files.

web.xml

<!-- web.xml -->

<web-app>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/gwtsecuritydemo-security.xml
            /WEB-INF/gwtsecuritydemo-base.xml
        </param-value>
    </context-param>

    <!-- Spring Security Filter Chain -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <listener>
        <listener-class>
            org.springframework.web.context.ContextLoaderListener
        </listener-class>
    </listener>

    <!-- Servlets -->
    <servlet>
        <servlet-name>greetServlet</servlet-name>
        <servlet-class>au.com.securitydemo.gwt.maven.sample.server.GreetingServiceImpl</servlet-class>
    </servlet>

    <servlet-mapping>
        <servlet-name>greetServlet</servlet-name>
        <url-pattern>/gwtsecuritydemo/greet</url-pattern>
    </servlet-mapping>

    <!-- Default page to serve -->
    <welcome-file-list>
        <welcome-file>gwtsecuritydemo.html</welcome-file>
    </welcome-file-list>

</web-app>

and

spring configuration.

<!-- Spring Config -->

<http auto-config="true">
    <intercept-url pattern="/*" access="ROLE_USER" />
</http>

<authentication-manager alias="authenticationManager">
    <authentication-provider>
        <user-service>
            <user authorities="ROLE_USER" name="guest" password="guest" />
        </user-service>
    </authentication-provider>
</authentication-manager>

Thanks, Bennet.

Could you publish the relevants part of your web.xml and your spring security config ? — otonglet

Tomasz Kańka Tomasz Kańka · Accepted Answer · 2013-11-07T10:05:53

You server preserved sessions during restart or you configured "remember-me cookie". To be sure, remove relevant cookies (usually JSESSIONID and REMEMBER_ME) from your browser and reload the page.

Spring Security in GWT

1 Answers