title: How to Enforce Change Password on User's initial login using Spring Security
body: <p>What would be the most elegant way of implementing a force password change upon user's initial login using Spring Security?</p>
  
  <p>I tried implementing a custom <code>AuthenticationSuccessHandler</code> as mentioned <a href="https://stackoverflow.com/a/3335886/1325425">here</a>, but as mentioned by <a href="https://stackoverflow.com/a/3338489/1325425">rodrigoap</a>, if a user manually inputs the URL at the address bar, the user will still be able to proceed to that page even if he didn't change his password.</p>
  
  <blockquote>
    <p>I did this with a filter ForceChangePasswordFilter. Because if the user types the url by hand they can bypass the change password form. With the filter the request always get intercepted.</p>
  </blockquote>
  
  <p>As such, I proceeded with implementing a custom filter. </p>
  
  <p>My question is this, when I implement a custom filter and send a redirect inside it, it goes through the filter again causing an infinite redirect loop as mentioned <a href="https://stackoverflow.com/questions/3954930/spring-security-3-0-how-do-i-specify-urls-to-which-a-custom-filter-applies">here</a>.
  I tried implementing the solution mentioned by declaring two http tags in my security-context.xml with the first tag having the <code>pattern</code> attribute as such but it still goes through my custom filter:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;http pattern="/resources" security="none"/&gt;
  &lt;http use-expressions="true" once-per-request="false"
      auto-config="true"&gt;
    &lt;intercept-url pattern="/soapServices/**" access="permitAll" requires-channel="https"/&gt;
    ...
    &lt;custom-filter position="LAST" ref="passwordChangeFilter" /&gt;
  &lt;/http&gt;
  ...
  &lt;beans:bean id="passwordChangeFilter"
    class="my.package.ForcePasswordChangeFilter"/&gt;
  &lt;beans:bean id="customAuthenticationSuccessHandler"
    class="my.package.CustomAuthenticationSuccessHandler" &gt;
  &lt;/beans:bean&gt;
  &lt;beans:bean id="customAuthenticationFailureHandler"
    class="my.package.CustomAuthenticationFailureHandler" &gt;
    &lt;beans:property name="defaultFailureUrl" value="/login"/&gt;
  &lt;/beans:bean&gt;
  </code></pre>
  
  <p>What my current implementation is (which works) is:</p>
  
  <ul>
  <li>Inside my custom authentication success handler, I set a session attribute <code>isFirstLogin</code></li>
  <li>In my ForcePasswordChangeFilter, I check if the session <code>isFirstLogin</code> is set
  
  <ul>
  <li>If it is, then I send a redirect to my force password change</li>
  <li>Else, I call <code>chain.doFilter()</code></li>
  </ul></li>
  </ul>
  
  <p>My problem with this implementation is that access to my resources folder also goes through this filter which causes my page to be distorted (because *.js and *.css are not successfully retrieved). 
  This is the reason I tried having two <code>&lt;http&gt;</code> tags in my security app context.xml (which didn't work). </p>
  
  <p>As such, I ended up having to manually filter the request if the servletPath starts or contains "/resources".
  I didn't want it to be like this - having to manually filter the request path - but for now it's what I have.</p>
  
  <p>What's the more elegant way of doing this?  </p>