title: How to permit forwarding to external URL with Spring Security
body: <p>I am wondering how can I make my "redirect:" workin with Spring Security.
  All /auth* pathes work correctly. But when it cames up to [1] it just doesn't redirect. Spring Security 4.0.2.RELEASE, Spring MVC 4.0.8.RELEASE</p>
  
  <pre><code>@Controller
  @RequestMapping(value = "/auth")
  public class SomeAuthController {
  
      @RequestMapping(value = "/external")
      public String externalAuth(...) {
          if(someCondition) return "redirect:" + someExternalUrl; // [1] https://external-service.com 
          else return "redirect:/"
      }
  
  }
  
  
  
  @Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(securedEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  
      @Autowired 
      public void registerGlobalAuthentication(AuthenticationManagerBuilder auth, 
                                               ShaPasswordEncoder shaPasswordEncoder,
                                               List&lt;AuthenticationProvider&gt; authProviders)
                                                                  throws Exception {
          for(AuthenticationProvider provider : authProviders) auth.authenticationProvider(provider);
      }
  
      @Bean(name="myAuthenticationManager")
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable().authorizeRequests().antMatchers("/resources/**").permitAll();
  
          http.authorizeRequests().antMatchers("/auth/**", "/").permitAll().anyRequest().authenticated();
  
          http.formLogin()
                  .loginPage("/auth/login")
                  .loginProcessingUrl("/j_spring_security_check")
                  .usernameParameter("j_username")
                  .passwordParameter("j_password")
                  .failureUrl("/auth/login?error")
                  .permitAll();
  
          http.logout()
                  .permitAll()
                  .logoutUrl("/auth/logout")
                  .logoutSuccessUrl("/")
                  .invalidateHttpSession(true);
      }
  
  
  }
  </code></pre>