title: Custom AuthenticationFailureHandler is not working as expected
body: <p>Registered handler in security configuration:</p>
  
  <pre class="lang-java prettyprint-override"><code>.formLogin().loginPage(/login).failureHandler(new CustomAuthenticationFailureHandler())
  </code></pre>
  
  <p>My custom failure handler:</p>
  
  <pre class="lang-java prettyprint-override"><code>public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {
  
      private String failureUrl="/login?error";
  
      private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
  
      @Override
      public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
                                          AuthenticationException exception) throws IOException, ServletException {
          this.redirectStrategy.sendRedirect(request, response, this.failureUrl);
      }
  
  }
  </code></pre>
  
  <p><code>onAuthenticationFailure</code> is getting triggered when auth failures happen but along with that one more request is also triggering by Spring, please find the another req stack,</p>
  
  <pre class="lang-none prettyprint-override"><code>LoginUrlAuthenticationEntryPoint.commence(HttpServletRequest, HttpServletResponse, AuthenticationException) line: 169   
  ExceptionTranslationFilter.sendStartAuthentication(HttpServletRequest, HttpServletResponse, FilterChain, AuthenticationException) line: 204 
  ExceptionTranslationFilter.handleSpringSecurityException(HttpServletRequest, HttpServletResponse, FilterChain, RuntimeException) line: 178  
  </code></pre>
  
  <p>So this request is overriding my sendredirect request.</p>
  
  <p>Should I need to configure/do anything else to achieve this ? Please help on this. 
  Thanks in advance</p>
  
  <p>My configuration:</p>
  
  <pre class="lang-java prettyprint-override"><code>    @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .addFilterBefore(SignUpFilter(userService), UsernamePasswordAuthenticationFilter.class)
                  .authorizeRequests()
                  .antMatchers(
                          "/",
                          "/register",
                          "/retrieveUsernameForm",
                      .permitAll()
              .and()
              .anonymous()
                  .authenticationProvider(anonymousAuthenticationProvider())
                  .authenticationFilter(anonymousAuthenticationFilter())
              .and()
                  .formLogin()
                       .loginPage(SecurityController.URI_LOGIN)
                       .failureHandler(new CustomAuthenticationFailureHandler())
                      .permitAll()
                      .defaultSuccessUrl(securityController.createUri(SecurityController.PATH_PART_LOGIN))
                  .and()
                  .rememberMe()
                  .rememberMeParameter("remember-me")
                  .key(REMEMBERME_TOKEN_KEY)
                  .rememberMeServices(tokenBasedRememberMeServices())
              .and()
                  .logout()
                  .permitAll()
              .and()
                  .headers()
                      .frameOptions().disable()
                      .addHeaderWriter(new StaticHeadersWriter("X-Frame-Options", "SAMEORIGIN"))
              .and()
                  .csrf().disable();
  
          http.formLogin()
                  .addObjectPostProcessor(new ObjectPostProcessor&lt;UsernamePasswordAuthenticationFilter&gt;() {
                      @Override
                      public UsernamePasswordAuthenticationFilter postProcess(UsernamePasswordAuthenticationFilter filter) {
                          filter.setSessionAuthenticationStrategy(sessionAuthenticationStrategyForContentAndStoreUsers());
                          return filter;
                      }
                  });
  
          http.exceptionHandling().accessDeniedHandler(accessDeniedHandler);
      }
  </code></pre>