Form-based login configuration in Spring Boot - Step-by-Step Execution

Concept Flow - Form-based login configuration

User opens login page

↓

User enters username & password

↓

Form submits credentials

↓

Spring Security intercepts request

↓

AuthenticationManager checks credentials

↓

Redirect to

↓

protected page

This flow shows how a user submits login info, Spring Security checks it, then redirects based on success or failure.

Execution Sample

Spring Boot

http
.formLogin()
.loginPage("/login")
.defaultSuccessUrl("/home")
.failureUrl("/login?error")
.and()
.authorizeHttpRequests()
.antMatchers("/login").permitAll();

Configures Spring Security to use a custom login page, redirect on success or failure, and allow all users to access the login page.

Execution Table

Step	Action	Input	Authentication Result	Redirect
1	User opens login page	GET /login	N/A	Show login form
2	User submits form	POST /login with username/password	Credentials checked	Depends on auth result
3	AuthenticationManager validates	username=alice, password=secret	Success	Redirect to /home
4	AuthenticationManager validates	username=alice, password=wrong	Failure	Redirect to /login?error
5	User sees redirected page	GET /home or /login?error	N/A	Show home or login with error

💡 Process ends after redirecting user based on authentication success or failure.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
username	null	alice	alice	alice	alice
password	null	secret or wrong	secret	wrong	secret or wrong
authenticationResult	null	pending	success	failure	success or failure
redirectUrl	null	null	/home	/login?error	final redirect

Key Moments - 3 Insights

Why does the login page show again with an error after a failed login?

Because authenticationResult is failure (see execution_table step 4), Spring Security redirects to /login?error to show the error message.

How does Spring Security know which page to show after login?

The defaultSuccessUrl setting (shown in execution_sample) tells it to redirect to /home on successful login (see execution_table step 3).

Can anyone access the login page without being authenticated?

Yes, permitAll() allows all users to access /login without authentication (see execution_sample and step 1 in execution_table).

Visual Quiz - 3 Questions

Look at the execution_table, what happens at step 3 when credentials are correct?

A Redirect to /home

B Redirect to /login?error

C Show login form again

D No redirect happens

💡 Hint

Check the Redirect column at step 3 in execution_table.

At which step does Spring Security check the username and password?

A Step 1

B Step 3

C Step 2

D Step 5

💡 Hint

Look at the Action and Authentication Result columns in execution_table.

If permitAll() was removed, what would happen when accessing /login at step 1?

A Login page shows normally

B Access denied or redirected to login forcibly

C User is redirected to login again causing a loop

D User is redirected to /home

💡 Hint

Refer to key_moments about permitAll() and step 1 in execution_table.

Concept Snapshot

Form-based login in Spring Boot:
- Use http.formLogin() to enable login form
- .loginPage("/login") sets custom login URL
- .defaultSuccessUrl("/home") redirects after success
- .failureUrl("/login?error") redirects after failure
- .permitAll() allows everyone to access login page

Full Transcript

Form-based login configuration in Spring Boot lets users enter username and password on a login page. When the user submits the form, Spring Security checks the credentials. If correct, it redirects to a protected page like /home. If wrong, it redirects back to the login page with an error message. The configuration uses methods like formLogin(), loginPage(), defaultSuccessUrl(), failureUrl(), and permitAll() to control this behavior. The login page must be accessible to all users, so permitAll() is important. This flow ensures secure and user-friendly login handling.