search

spring-projects / spring-security

Spring Security
http://spring.io/projects/spring-security
Apache License 2.0
8.86k stars 5.91k forks source link

SEC-2112: ExceptionMappingAuthenticationFailureHandler does not forward to failure destination #2337

Open spring-projects-issues opened 11 years ago

spring-projects-issues commented 11 years ago

Max Englander (Migrated from SEC-2112) said:

ExceptionMappingAuthenticationFailureHandler does not forward to the destination failure url if it is configure to do so with setUseForward.

The documentation for ExceptionMappingAuthenticationFailureHandler does not specify whether it will forward to to destination failure url if it is configured to do so.

http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/web/authentication/ExceptionMappingAuthenticationFailureHandler.html

I think, given that it inherits from SimpleUrlAuthenticationFailureHandler (which does forward if configured to do so), either it ought to forward as well, or else the documentation should specify that it will not.

spring-projects-issues commented 11 years ago

Rob Winch said:

We should also consider that saveException is not invoked.