title: incorrect redirection of spring security after login
body: <p><strong>Edit --</strong></p>
  
  <p>My guess is that the original url request in the first place was"/" , so on success login, the user is landed to "/" . </p>
  
  <p>If the user had entered site.com/someOtherUrl before login, he would be landed to site.com/someOtherUrl after login success. How to tackle that/</p>
  
  <p><strong>Edit end --</strong></p>
  
  <p>for <code>mysite.com</code> or <code>localhosr:8080</code> when a user comes, </p>
  
  <p>he lands to <code>/login</code> page then he enters credentials and presses login button. </p>
  
  <p>now he is actually <strong>logged in</strong>. he should land at <code>/users/home</code> </p>
  
  <p><strong>but he lands at</strong> <code>/</code></p>
  
  <p>At this moment, as he is logged in, he can manually go to <code>/users/home</code> by using address bar.</p>
  
  <p>An uninformed user (about the problem) would hit the back button and login again and then land to the correct url <code>/users/home</code> page as the way he should </p>
  
  <p><strong>the question</strong> is, why not the first time? why he lands to "/" in the first time instead of /users/home despite he WAS logged in?</p>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:security="http://www.springframework.org/schema/security"
   xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
     http://www.springframework.org/schema/security
     http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
   &lt;!-- This is where we configure Spring-Security  --&gt;
   &lt;security:http auto-config="true" use-expressions="true" access-denied-page="/loginfail" &gt;
  
   &lt;security:intercept-url pattern="/" access="permitAll"/&gt;
   &lt;security:intercept-url pattern="/favicon.ico" access="permitAll"/&gt;  &lt;!-- lolz --&gt;
    &lt;security:intercept-url pattern="/login" access="permitAll"/&gt;
    &lt;security:intercept-url pattern="/logout" access="permitAll"/&gt;
    &lt;security:intercept-url pattern="/loginfail" access="permitAll"/&gt;
    &lt;security:intercept-url pattern="/resources/**" access="permitAll"/&gt;
    &lt;security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/&gt;
  
  
  
    &lt;security:form-login
      login-page="/login"
  
      authentication-failure-url="/login?error=true"
  
      default-target-url="/users/home"/&gt;
    &lt;!-- authentication-failure-url="/loginfail?error=true" --&gt;   
  
  
    &lt;security:logout
      invalidate-session="true"
      logout-success-url="/login"
      logout-url="/logout"/&gt;
  
   &lt;/security:http&gt;
  
  
   &lt;!-- Declare an authentication-manager to use a custom userDetailsService --&gt;
   &lt;security:authentication-manager&gt;
           &lt;security:authentication-provider user-service-ref="customUserDetailsService"&gt;
    &lt;!--         &lt;security:password-encoder ref="passwordEncoder"/&gt;--&gt;
           &lt;/security:authentication-provider&gt;
   &lt;/security:authentication-manager&gt;
  
   &lt;!-- Use a Md5 encoder since the user's passwords are stored as Md5 in the database 
   &lt;bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder"/&gt;
   --&gt;
   &lt;!-- A custom service where Spring will retrieve users and their corresponding access levels  --&gt;
   &lt;bean id="customUserDetailsService" class="web.service.common.CustomUserDetailsService"/&gt;
     &lt;!--For loging security activity--&gt;
      &lt;!--&lt;bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener" /&gt;--&gt;
  
  
  
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
      &lt;welcome-file-list&gt;
          &lt;!--&lt;welcome-file&gt;login&lt;/welcome-file&gt; --&gt;
          &lt;welcome-file&gt;login.jsp&lt;/welcome-file&gt;
          &lt;!--&lt;welcome-file&gt;redirect.jsp&lt;/welcome-file&gt;--&gt;
          &lt;!--&lt;welcome-file&gt;WEB-INF/view/jsp/login/login.jsp&lt;/welcome-file&gt;--&gt;
      &lt;/welcome-file-list&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;springDispatcher&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;springDispatcher&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  
      &lt;/servlet-mapping&gt;
      &lt;session-config&gt;
          &lt;session-timeout&gt;
              30
          &lt;/session-timeout&gt;
      &lt;/session-config&gt;
  &lt;!--    &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;redirect.jsp&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;--&gt;
  
  
  
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              /WEB-INF/spring-security.xml
              /WEB-INF/applicationContext.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>CustomUserDetailsService</p>
  
  <pre><code>package web.service.common;
  
  import java.util.ArrayList;
  import java.util.Collection;
  import java.util.List;
  import javax.annotation.Resource;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.dao.DataAccessException;
  import org.springframework.security.core.GrantedAuthority;
  import org.springframework.security.core.userdetails.User;
  import org.springframework.security.core.userdetails.UserDetails;
  import org.springframework.security.core.userdetails.UserDetailsService;
  import org.springframework.security.core.userdetails.UsernameNotFoundException;
  import org.springframework.stereotype.Repository;
  import org.springframework.stereotype.Service;
  import web.dao.UsersDAO;
  import web.dao.impl.jpa.UsersDAOImpl;
  import web.entity.Users;
  
  
  
  @Service
  public class CustomUserDetailsService implements UserDetailsService{
  
      //@Resource
     @Autowired
     private UsersDAO userDAO;
  
  
   /**
    * Retrieves a springUser record containing the springUser's credentials and access.
    */
   public UserDetails loadUserByUsername(String email)
     throws UsernameNotFoundException, DataAccessException {
  
  
    // Declare a null Spring User
    UserDetails springUser = null;
  
  
    try {
      System.out.println("the email passed from CustomUserDetailsService in method loadUserByUsername is: " +email);
     // Search database for a springUser that matches the specified email
     // You can provide a custom DAO to access your persistence layer
     // Or use JDBC to access your database
     // DbUser is our custom domain springUser. This is not the same as Spring's User
        System.out.println("debug ---- 1");
     Users dbUser = userDAO.getUserByLoginId(email);
  
     // Populate the Spring User object with details from the dbUser
     // Here we just pass the email, password, and access level
     // getAuthorities() will translate the access level to the correct role type
   System.out.println("debug ---- 2");
     springUser =  new User(
       dbUser.getEmail(),
       dbUser.getPassword().toLowerCase(),
       true,
       true,
       true,
       true,
       //getAuthorities(dbUser.getAccess()) );
       getAuthorities(2) );
   System.out.println("debug ---- 3");
    } catch (Exception e) {
     System.out.println("print Error in retrieving user");
     e.printStackTrace();
      System.out.println(e.getMessage());
     throw new UsernameNotFoundException("Error in retrieving user");
    }
     System.out.println("debug ---- 4");
    // Return springUser to Spring for processing.
    // Take note we're not the one evaluating whether this springUser is authenticated or valid
    // We just merely retrieve a springUser that matches the specified email
    return springUser;
   }
  
   /**
    * Retrieves the correct ROLE type depending on the access level, where access level is an Integer.
    * Basically, this interprets the access value whether it's for a regular springUser or admin.
    *
    * @param access an integer value representing the access of the springUser
    * @return collection of granted authorities
    */
    public Collection&lt;GrantedAuthority&gt; getAuthorities(Integer access) {
     // Create a list of grants for this springUser
     List&lt;GrantedAuthority&gt; authList = (List&lt;GrantedAuthority&gt;) new ArrayList&lt;GrantedAuthority&gt;(2);
  
     // All users are granted with ROLE_USER access
     // Therefore this springUser gets a ROLE_USER by default
     System.out.println("Grant ROLE_USER to this user");
     authList.add(new GrantedAuthorityImpl("ROLE_USER"));
  
     // Check if this springUser has admin access
     // We interpret Integer(1) as an admin springUser
  
  //   if ( access.compareTo(1) == 0) {
  //    // User has admin access
  //    logger.debug("Grant ROLE_ADMIN to this user");
  //    authList.add(new GrantedAuthorityImpl("ROLE_ADMIN"));
  //   }
  
     // Return list of granted authorities
     return authList;
     }
  
  }
  </code></pre>