spring-projects / spring-projects/spring-security
Custom Prompts in DefaultLoginPageGeneratingFilter
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Depending on why credentials are being requested, DefaultLoginPageGeneratingFilter should prompt the user with different messages. A few examples can help to clarify:
- If the user is not authenticated, it should say something like "Please Log In".
- If a user is already authenticated, but an additional factor is being requested, it should say something like "Please confirm your identity"
- If a user is already authenticated with a specific factor, but it wasn't recently enough, it should say something like "This page has requested that you provide your credentials again to verify your identity".
NOTE: Do not just use the prompts above, they are just examples. The prompts should be thought of carefully and refined.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with DefaultLoginPageGeneratingFilter and trace how it determines why credentials are being requested. Define and refine distinct prompts for unauthenticated users, additional-factor requests, and recently invalid authentication before checking the existing filter tests; done means each described context produces an appropriate, reviewed message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100