Search code examples
javaspringspring-securityfiddler

Spring security really strange behaviour in IE

I'm having the weirdest problem I have ever seen before.

The application I am working on uses spring security 3.1.3 to provide authentication support. There is a custom login form for which I have implemented a custom authenticationmanager / successhandler and failurehandler.

For some reason on internet explorer I always get the error message "Please fill in all mandatory fields". This is caused by appending /login?error=1 to the end of my url which can only be accessed through the following code (the redirectAndAddError method):

public class TideUserNamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

public TideUserNamePasswordAuthenticationFilter() {
    super();
}

@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) {

    String username = request.getParameter(SPRING_SECURITY_FORM_USERNAME_KEY);
    String password = request.getParameter(SPRING_SECURITY_FORM_PASSWORD_KEY);

    if (StringUtils.isBlank(username) || StringUtils.isBlank(password)) {
        redirectAndAddError(response);
        return null;
    }

    return super.attemptAuthentication(request, response);
}

private void redirectAndAddError(HttpServletResponse response) {
    try {
        response.sendRedirect("/tide/login?error=1");
    } catch (IOException e) {
        throw new AuthenticationServiceException(e.getMessage(), e);
    }
}

So what I tried was using Fiddler2, a web debugging proxy to view if one of the two parameters are actually empty. The strange thing is that when this program is running the error does not occur anymore and I can log on successfully.

Had anyone had a similar problem before? I think it's not related to my code as running the tool suddenly "solves" the problem.

This problem only occurs in internet explorer which makes it even more strange.

Edit

I have used another tool to watch the requests and this is what happens in IE:

First a POST request is sent to the uri /authenticate, I have set this myself like this:

<beans:property name="filterProcessesUrl" value="/authenticate"/>

The response of that request has http status code 302, moved temporarily and returns that the new location is at /login?error=1 (my form with the mandatory fields required error).

After that a GET request occurs to /login?error=1 with status code 401: Unauthorized. The intercept-url is set up like this:

 <intercept-url pattern="/login**" access="permitAll"/>

The next request is a GET request to /login?error=1 again, this time the status code is showing: ERROR_INTERNET_CONNECTION_RESET, which looks like it could be a problem.

In Google Chrome the following request is made:

POST to /authenticate, result is a 302: moved temporarily to the dashboard page (which I display after logging on)

Solution

  • Someone on my team finally figured out what the problem was after finding this issue in the chromium bugtracker:

    https://code.google.com/p/chromium/issues/detail?id=62687

    The problem has been resolved by adding this in our login controller

    @RequestMapping(value = "/login", method = RequestMethod.POST)
public String doLogin() throws ServletException, IOException {
    return "forward:/authenticate";
}

    and changing the url that the form posts to to this one instead of the authentication url that spring security provides (we are redirecting to it manually now)