Form-based login configuration in Spring Boot - Step-by-Step Execution

Concept Flow - Form-based login configuration

User opens login page

↓

User enters username & password

↓

Form submits credentials

↓

Spring Security intercepts request

↓

AuthenticationManager checks credentials

↓

Redirect to

↓

protected page

This flow shows how a user submits login info, Spring Security checks it, then redirects based on success or failure.

Execution Sample

Spring Boot

http
.formLogin()
.loginPage("/login")
.defaultSuccessUrl("/home")
.failureUrl("/login?error")
.and()
.authorizeHttpRequests()
.antMatchers("/login").permitAll();

Configures Spring Security to use a custom login page, redirect on success or failure, and allow all users to access the login page.

Execution Table

Step	Action	Input	Authentication Result	Redirect
1	User opens login page	GET /login	N/A	Show login form
2	User submits form	POST /login with username/password	Credentials checked	Depends on auth result
3	AuthenticationManager validates	username=alice, password=secret	Success	Redirect to /home
4	AuthenticationManager validates	username=alice, password=wrong	Failure	Redirect to /login?error
5	User sees redirected page	GET /home or /login?error	N/A	Show home or login with error

💡 Process ends after redirecting user based on authentication success or failure.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
username	null	alice	alice	alice	alice
password	null	secret or wrong	secret	wrong	secret or wrong
authenticationResult	null	pending	success	failure	success or failure
redirectUrl	null	null	/home	/login?error	final redirect

Key Moments - 3 Insights

Why does the login page show again with an error after a failed login?

Because authenticationResult is failure (see execution_table step 4), Spring Security redirects to /login?error to show the error message.

How does Spring Security know which page to show after login?

The defaultSuccessUrl setting (shown in execution_sample) tells it to redirect to /home on successful login (see execution_table step 3).

Can anyone access the login page without being authenticated?

Yes, permitAll() allows all users to access /login without authentication (see execution_sample and step 1 in execution_table).

Visual Quiz - 3 Questions

Look at the execution_table, what happens at step 3 when credentials are correct?

A Redirect to /home

B Redirect to /login?error

C Show login form again

D No redirect happens

💡 Hint

Check the Redirect column at step 3 in execution_table.

At which step does Spring Security check the username and password?

A Step 1

B Step 3

C Step 2

D Step 5

💡 Hint

Look at the Action and Authentication Result columns in execution_table.

If permitAll() was removed, what would happen when accessing /login at step 1?

A Login page shows normally

B Access denied or redirected to login forcibly

C User is redirected to login again causing a loop

D User is redirected to /home

💡 Hint

Refer to key_moments about permitAll() and step 1 in execution_table.

Concept Snapshot

Form-based login in Spring Boot:
- Use http.formLogin() to enable login form
- .loginPage("/login") sets custom login URL
- .defaultSuccessUrl("/home") redirects after success
- .failureUrl("/login?error") redirects after failure
- .permitAll() allows everyone to access login page

Full Transcript

Form-based login configuration in Spring Boot lets users enter username and password on a login page. When the user submits the form, Spring Security checks the credentials. If correct, it redirects to a protected page like /home. If wrong, it redirects back to the login page with an error message. The configuration uses methods like formLogin(), loginPage(), defaultSuccessUrl(), failureUrl(), and permitAll() to control this behavior. The login page must be accessible to all users, so permitAll() is important. This flow ensures secure and user-friendly login handling.

Practice

1. What is the main purpose of formLogin() in Spring Security?

easy

A. To enable form-based login for user authentication

B. To disable all login methods

C. To configure database connections

D. To set up REST API endpoints

Solution

1. Step 1: Understand formLogin() role

   The formLogin() method in Spring Security enables users to log in using a web form.

2. Step 2: Compare with other options

   Other options like disabling login or configuring database are unrelated to formLogin().

3. Final Answer:

   To enable form-based login for user authentication -> Option A

4. Quick Check:

   formLogin() enables form login [OK]

Hint: Remember formLogin() means login via web form [OK]

Common Mistakes:

• Confusing formLogin() with database setup
• Thinking formLogin() disables login
• Mixing formLogin() with API configuration

2. Which of the following is the correct way to customize the login page URL in Spring Security?

easy

A. http.formLogin().loginPath("/custom-login")

B. http.formLogin().loginPage("/custom-login")

C. http.formLogin().pageUrl("/custom-login")

D. http.formLogin().setLoginUrl("/custom-login")

Solution

1. Step 1: Identify correct method for login page URL

   The method to set a custom login page URL is loginPage() used after formLogin().

2. Step 2: Verify syntax correctness

   Only http.formLogin().loginPage("/custom-login") uses the correct method name and syntax: loginPage("/custom-login").

3. Final Answer:

   http.formLogin().loginPage("/custom-login") -> Option B

4. Quick Check:

   loginPage() sets custom login URL [OK]

Hint: Use loginPage() to set custom login URL [OK]

Common Mistakes:

• Using incorrect method names like setLoginUrl()
• Confusing loginPage() with other methods
• Missing parentheses or quotes

3. Given the following Spring Security configuration snippet, what will be the behavior when a user accesses /login?

http
  .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
  .formLogin(form -> form.loginPage("/login").permitAll());

medium

A. Users are blocked from accessing /login without authentication

B. Users can access all pages without login

C. Users are redirected to the default login page instead of /login

D. Users see a custom login page at /login and can access it without authentication

Solution

1. Step 1: Analyze authorizeHttpRequests configuration

   All requests require authentication because of anyRequest().authenticated().

2. Step 2: Analyze formLogin configuration

   The login page is customized to /login and permitAll() allows everyone to access it without login.

3. Final Answer:

   Users see a custom login page at /login and can access it without authentication -> Option D

4. Quick Check:

   Custom login page with permitAll() means public access [OK]

Hint: permitAll() on loginPage() allows public access [OK]

Common Mistakes:

• Assuming /login requires authentication
• Thinking default login page is used
• Ignoring permitAll() effect

4. Identify the error in this Spring Security configuration snippet:

http
  .formLogin()
  .loginPage("/my-login")
  .permitAll();

medium

A. permitAll() should be called on authorizeHttpRequests, not formLogin

B. loginPage() must be called before formLogin()

C. permitAll() is not a valid method in Spring Security

D. The code is correct and will work as expected

Solution

1. Step 1: Check method chaining correctness

   In Spring Security, permitAll() is used on authorization rules, not directly on formLogin().

2. Step 2: Understand correct usage

   To allow public access to the login page, permitAll() should be called on the authorization configuration for the login page URL.

3. Final Answer:

   permitAll() should be called on authorizeHttpRequests, not formLogin -> Option A

4. Quick Check:

   permitAll() belongs to authorization, not formLogin [OK]

Hint: permitAll() controls access, use it in authorizeHttpRequests [OK]

Common Mistakes:

• Calling permitAll() on formLogin()
• Misplacing loginPage() call
• Assuming permitAll() is invalid

5. You want to create a Spring Security setup where: - The login page is at /user-login - The login page is accessible without authentication - All other pages require login Which configuration snippet correctly achieves this?

hard

A. http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
.formLogin(form -> form.loginPage("/user-login").permitAll());

B. http.formLogin().loginPage("/user-login").permitAll()
.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());

C. http.authorizeHttpRequests(auth -> auth.requestMatchers("/user-login").permitAll().anyRequest().authenticated())
.formLogin(form -> form.loginPage("/user-login"));

D. http.authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
.formLogin(form -> form.loginPage("/user-login"));

Solution

1. Step 1: Permit access to the login page

   Use requestMatchers("/user-login").permitAll() to allow unauthenticated access to the login page.

2. Step 2: Require authentication for all other requests

   Use anyRequest().authenticated() to protect all other endpoints.

3. Step 3: Configure form login with custom login page

   formLogin(form -> form.loginPage("/user-login")) sets the custom login page.

4. Final Answer:

   http.authorizeHttpRequests(auth -> auth.requestMatchers("/user-login").permitAll().anyRequest().authenticated()) .formLogin(form -> form.loginPage("/user-login")); -> Option C

5. Quick Check:

   Properly permits login page and protects others [OK]

Hint: Explicitly permit login page URL in authorizeHttpRequests [OK]

Common Mistakes:

• Not permitting the login page URL (option A)
• Invalid chaining after formLogin.permitAll() (option B)
• Permitting all requests (option D)