title: Spring security login gives error page, is authentication failing?
body: <p>I am new to spring security (security in general) and I am trying to create a user login that goes to a products page when successfully logged in. Following all the tutorials I have come across in regard to the security configuration, I keep getting "login?error" and I cant figure out why, I cant pinpoint it in the debugger.</p>
  
  <p>I am using Postgresql and have tables user, role, user_role. I have verified my sql statements for jdbcAuthentication and have configured the .formLogin many different ways</p>
  
  <p>Below is my web security configuration, login controller, and login view.
  Can anyone tell what I am doing wrong? Thank you.</p>
  
  <p><strong>SpringSecurityConfig.java</strong></p>
  
  <pre><code>
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  import org.springframework.security.crypto.password.PasswordEncoder;
  import org.springframework.security.web.access.AccessDeniedHandler;
  
  import javax.sql.DataSource;
  
  @Configuration
  @EnableWebSecurity
  public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
  
  
      @Autowired
      private DataSource dataSource;
  
  
      @Autowired
      public void configAuthentication(AuthenticationManagerBuilder auth) throws Exception {
  
          // Database authentication
          auth.
                  jdbcAuthentication()
                  .dataSource(dataSource)
                  .usersByUsernameQuery("SELECT username, password, active FROM \"user\" WHERE username = ?")
                  .authoritiesByUsernameQuery("SELECT u.username, r.role FROM \"user\" u join user_role ur on (u.userid=ur.userid) join role r on (ur.roleid=r.roleid) WHERE u.username = ?");
  
      }
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
                  .authorizeRequests()
                  .antMatchers("/products","/mycart","/images/**").permitAll()
                  .anyRequest().authenticated()
                  .and()
                  .formLogin()
                  .loginPage("/login")
                  .successForwardUrl("/products")
                  .usernameParameter("username")
                  .passwordParameter("password")
                  .permitAll()
                  .and()
                  .logout()
                  .permitAll();
  
      }
  
      @Bean
      public PasswordEncoder passwordEncoder(){
          return new BCryptPasswordEncoder();
      }
  
  
  }
  
  </code></pre>
  
  <p><strong>LoginController.java</strong></p>
  
  <pre><code>import org.springframework.stereotype.Controller;
  import org.springframework.web.bind.annotation.*;
  import java.security.Principal;
  
  @Controller
  public class LoginController {
  
      @RequestMapping(value = {"/", "/login"}, method = RequestMethod.GET)
      public String loginView(Principal principal) {
  
          return "/login";
      }
  }
  </code></pre>
  
  <p><strong>login.html</strong></p>
  
  <pre><code>&lt;html lang="en" xmlns:th="http://www.thymeleaf.org"&gt;
  
  &lt;head&gt;
      &lt;meta charset="UTF-8"&gt;
      &lt;title&gt;Login&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div&gt;
      &lt;form th:action="@{/login}" method="POST"&gt;
  
          &lt;div th:if="${param.error}"&gt;
              &lt;div class="alert alert-danger"&gt;
                  Incorrect Username and Password
              &lt;/div&gt;
          &lt;/div&gt;
  
          &lt;div th:if="${param.logout}"&gt;
              &lt;div class="alert alert-danger"&gt;
                  User Logged Out
              &lt;/div&gt;
          &lt;/div&gt;
  
          &lt;div class="form-group"&gt;
              &lt;input type="text" placeholder="Username" id="username" class="form-control" required="true" autofocus="true"/&gt;
          &lt;/div&gt;
  
          &lt;div class="form-group"&gt;
              &lt;input type="password" placeholder="Password" id="password" class="form-control" required="true" autofocus="true"/&gt;
          &lt;/div&gt;
  
          &lt;div&gt;
              &lt;input type="submit" class="btm btm-primary btn-block" value="Login"/&gt;
          &lt;/div&gt;
      &lt;/form&gt;
  
      &lt;a href="/registration"&gt;Register&lt;/a&gt;
  &lt;/div&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>