Why the exception UsernameNotFoundException does not stop application? - spring-security

Question

I am using Spring Security to do authentication. Here is my code :
Controller
#RequestMapping(value="/custom_login", method = RequestMethod.GET)
public String customLogin(){
return VIEW_LOGIN_SUCCESS_NAME;
}
Authentication
#Override
public UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException {
com.startup.app.models.entities.User domainUser = userDao.getUserByLogin(username);
if (domainUser == null) {
LOGGER.error("No user found with username: " + username);
throw new UsernameNotFoundException("No user found with username: " + username);
}
boolean enabled = true;
boolean accountNonExpired = true;
boolean credentialsNonExpired = true;
boolean accountNonLocked = true;
return new User(
domainUser.getEmail(),
domainUser.getPassword(),
enabled,
accountNonExpired,
credentialsNonExpired,
accountNonLocked,
getAuthorities(domainUser.getRole())
);
}
Here is the spring configuration file:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jdbc="http://www.springframework.org/schema/jdbc"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/jdbc
http://www.springframework.org/schema/jdbc/spring-jdbc-3.2.xsd">
<!-- configuration des urls -->
<security:http auto-config="true">
<!-- Define the default login page -->
<security:form-login login-page="/custom_login" username-parameter="email" password-parameter="password" default-target-url="/loginSuccess"/>
</security:http>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider
ref="authenticationProvider" />
</security:authentication-manager>
<bean id="authenticationProvider"
class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<property name="userDetailsService" ref="userDetailsService" />
</bean>
<bean id="webexpressionHandler" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler" />
<bean id="userDetailsService" class="com.startup.app.services.login.CustomUserDetailsServiceImpl" />
</beans>
In the above configuration, i know i did not restrict access to page. I just first want to test the login process is working well.
I don't understand why the application does not stop when the UsernameNotFoundException is thrown. I don't have message in eclipse about except the logger i've used. Then the application continue to execute and display the login success page.
Someone could explain me please ?

Answer 1

please change your login config:
<security:form-login
authentication-success-handler-ref="authenticationSuccessHandler"
login-page="/custom_login"
username-parameter="email"
password-parameter="password"
default-target-url="/loginSuccess"
always-use-default-target="true"
authentication-failure-url="/custom_login" />
For even more control over the destination, you can use the authentication-success-handler-ref attribute as an alternative to default-target-url. The referenced bean should be an instance of AuthenticationSuccessHandler.