 <p>First you don't need a controller, spring security handles all this for you. So drop the controller. </p> <p>The current problem is due to your JSON based post. This is handled by the normal filter which handles login, but it doesn't see a <code>j_username</code> and <code>j_password</code> field and as such will redirect (the 302) to the login page (in your case <code>/shop/home.html</code>) asking for those fields. </p> <p>Basically you are posting the data as JSON whereas it simply should be just an ajaxified form post. This allows you to write a simple <code>AuthenticationSuccessHandler</code> which simply returns a 401 or a 200 status-code (and maybe a body) when things are ok. </p> <p>Changing your ajax submit to something like this should make things work.</p> <pre><code>var data = $(this).serializeObject(); $.ajax({ 'type': $(this).action, 'url': $(this).target, 'data': data }): </code></pre> <p>This should create a ajax form post. Might be that you need a call to <code>preventDefault()</code> in the surrounding method to stop the form from actual posting. </p>