title: Spring MVC/Security - Users still can access login page after successful login
body: <p>I am very new to Spring.</p>
  
  <p>I am working with version 4.3.9.RELEASE of Spring MVC, 4.2.3.RELEASE of Spring Security.</p>
  
  <p>I am using the built in login of spring with a little customization, here is my configure</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      private UserDetailsService myUserService;
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {       
          auth
              .userDetailsService(myUserService);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
                  .antMatchers("/resources/**").permitAll()
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .loginPage("/login")
                  .permitAll()
                  .and()
              .rememberMe()
                  .alwaysRemember(true)
                  .and()
              .logout()
                  .permitAll();
  
      }
  }
  </code></pre>
  
  <p>Why users can access login page after they logged in successfully? I tried to learn from the questions that are the same like mine, but none of them works with me.</p>
  
  <p>This solution doesn't work with me:</p>
  
  <pre><code>&lt;sec:authorize access="isAuthenticated()"&gt;
    &lt;% response.sendRedirect(request.getContextPath()); %&gt;
  &lt;/sec:authorize&gt;
  </code></pre>
  
  <p>I am using Apache Tiles, I have is_authenticated.jsp with that  part. and this is the tiles.xml: </p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE tiles-definitions PUBLIC
          "-//Apache Software Foundation//DTD Tiles Configuration 3.0//EN"
          "http://tiles.apache.org/dtds/tiles-config_3_0.dtd"&gt;
  
  &lt;tiles-definitions&gt;
    &lt;definition name="base" template="/WEB-INF/layouts/page.jsp"&gt;
      &lt;put-attribute name="pageHeader" value="/WEB-INF/layouts/page_header.jsp"&gt;&lt;/put-attribute&gt;
      &lt;put-attribute name="pageFooter" value="/WEB-INF/layouts/page_footer.jsp"&gt;&lt;/put-attribute&gt;
    &lt;/definition&gt;
  
    &lt;definition name="login" extends="base"&gt;
      &lt;put-attribute name="isAuthenticated" value="/WEB-INF/views/is_authenticated.jsp"&gt;&lt;/put-attribute&gt;
      &lt;put-attribute name="pageBody" value="/WEB-INF/views/login.jsp"&gt;&lt;/put-attribute&gt;
    &lt;/definition&gt;
  
    &lt;definition name="home" extends="base"&gt;
      &lt;put-attribute name="isAuthenticated" value=""&gt;&lt;/put-attribute&gt;
      &lt;put-attribute name="pageBody" value="/WEB-INF/views/home.jsp"&gt;&lt;/put-attribute&gt;
    ...
  &lt;/tiles-definitions&gt;
  </code></pre>
  
  <p>and here is page.jsp</p>
  
  <pre><code>&lt;!DOCTYPE&gt;
  &lt;html&gt;
  &lt;head&gt;
      &lt;t:insertAttribute name="isAuthenticated"&gt;&lt;/t:insertAttribute&gt;  
      ...
  &lt;/head&gt;
  
  &lt;body&gt;
      &lt;!-- Page Layout HTML --&gt;
      &lt;header id="pageHeader"&gt;
      &lt;t:insertAttribute name="pageHeader"&gt;&lt;/t:insertAttribute&gt;
      &lt;/header&gt;
  
      &lt;main id="pageBody"&gt;
      &lt;t:insertAttribute name="pageBody"&gt;&lt;/t:insertAttribute&gt;
      &lt;/main&gt;
      ...
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>The is_authenticated.jsp is included and rendered but it doesn' work, it does work only if I put the  block inside the page.jsp itself, which looks wrong as you see, but it doesn't work when included from another jsp file.</p>
  
  <p>Another solution, handling this issue from login controller, but this is not available in my case, because I didn't use any controller to handle login process. 
  Should I do? 
  The custom login controller will be more secure than the default one in Spring?</p>
  
  <p><strong>Update1</strong> </p>
  
  <p>I tried to use the default login feature of spring:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      private UserDetailsService myUserService;
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {       
          auth
              .userDetailsService(myUserService);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
                  .antMatchers("/resources/**").permitAll()
                  .anyRequest().authenticated()
                  .and()
              .formLogin();
  
      }
  }
  </code></pre>
  
  <p>But I found that after successful login, user can still access login page.
  So I am guessing I need to have a method in LoginController to accomplish this.</p>