Spring Security 3.1.3 request querystring stripped

U can get it from SuccessHandler

SecurityConfiguration class

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
SuccessHandler getSuccessHandler;

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()

    .antMatchers("/dashboard/**",               
            "/feedback/**"
            ).access("hasRole('ROLE_SYSTEM_ADMIN') or hasRole('ROLE_COMPANY_ADMIN')")

    .and().formLogin().loginPage("/login").successHandler(getSuccessHandler)
    .loginProcessingUrl("/login").usernameParameter("ssoId").passwordParameter("password")      
    .and().csrf()
    .and().exceptionHandling().accessDeniedPage("/Access_Denied")
    .and()
    .sessionManagement().invalidSessionUrl("/login").maximumSessions(1).expiredUrl("/login").and().sessionAuthenticationErrorUrl("/login").sessionFixation().migrateSession()
    .sessionCreationPolicy(SessionCreationPolicy.ALWAYS); //always, IF_REQUIRED,never ,stateless    

    http.logout()
    .logoutUrl("/logout")
    .logoutSuccessUrl("/login")
    .invalidateHttpSession(true)
    .permitAll();
}

 @Override
  public void configure(WebSecurity web) throws Exception {
    web
    .ignoring()     
    .antMatchers("/static/**")
    .antMatchers("/images/**");       
     }
}

SuccessHandler class

@Component
public class SuccessHandler implements AuthenticationSuccessHandler {


@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
    Authentication authentication) throws IOException, ServletException {

    HttpSession session = request.getSession();
    response.sendRedirect(request.getContextPath() + "/dashboard/index");
}
}

Leave a Comment