Make spring security add the return to url in the query string for the login page

Question

Earlier I asked if it was possible to get the original request url in the form login page in Spring Security 2. Turns out that actually won't help me, what I need is for the redirect to the form-login page to have that embedded in it as a request parameter. So if I have:

<form-login login-page="/login.html" /> 

and try to access /secure.html I want to end up in /login.html?return_to=/secure.html.

Answer 1

I guess you need to use spring-security-redirect. Essentially, if your url is of the form /login.html?spring-security-redirect=/secure.html, spring security will automagically redirect to secure.html on successful login.

As of spring 3.1.x this no longer works out-of-the-box. You'll need to add:

authentication-success-handler-ref="simpleUrlAuthenticationSuccessHandler"

...to your <form-login> element and add a bean that looks like:

<!-- Emulates the functionality of spring security 3.0.x by specifying the targetUrlParameter to be the value it
    defaulted to in 3.0.x. As of 3.1.x this is null by default with no option to specify in <form-login> -->
<beans:bean id="simpleUrlAuthenticationSuccessHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
    <beans:property name="useReferer" value="true"/>
    <beans:property name="defaultTargetUrl" value="/account"/>
    <beans:property name="targetUrlParameter" value="spring-security-redirect"/>
</beans:bean>