SEC-2185: SPRING_SECURITY_LAST_EXCEPTION not saved when using ExceptionMappingAuthenticationFailureHandler

Bruno Bertoni de Paula (Migrated from SEC-2185) said:

When using ExceptionMappingAuthenticationFailureHandler, session scoped variable SPRING_SECURITY_LAST_EXCEPTION is not saved.
The saveException is called only when using default failure handler.
As workaround, i had to override the function onAuthenticationFailure:

@Override
public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
AuthenticationException exception) throws IOException, ServletException {
saveException(request, exception); //
super.onAuthenticationFailure(request, response, exception);
}

Another issues involved:

1. useForward property has no effect when using ExceptionMappingAuthenticationFailureHandler, because on code, if url is found in exceptionMapping list, there is a sendRedirect directly, without checking instance variable useForward.

2. I noticed that when using useForward=true, the SPRING_SECURITY_LAST_EXCEPTION is saved on request scope, not session scope.
   but after that, thet getRequestDispatcher(url).forward is called. In this case, when I need to get SPRING_SECURITY_LAST_EXCEPTION value in JSP, for example, i have to use request.getAttribute("javax.servlet.forward.SPRING_SECURITY_LAST_EXCEPTION") instead of request.getAttribute("SPRING_SECURITY_LAST_EXCEPTION").message. Because of this sutle confusion, that would be better to save last exception always in session scope? This is not a bug, just a suggestion.

Start at ExceptionMappingAuthenticationFailureHandler and its onAuthenticationFailure path, then trace saveException, exceptionMapping, and useForward. Verify the mapped-failure path saves SPRING_SECURITY_LAST_EXCEPTION and that forwarding versus redirecting follows useForward, including the documented request or session scope behavior.