spring-projects / spring-projects/spring-security

AbstractAuthenticationFilterConfigurer failureUrl Javadoc is incorrect

Open Beginner friendly
#9,229 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: docs type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

The failureUrl(String) Javadoc states that this method is a shortcut for invoking failureHandler(AuthenticationFailureHandler), which is incorrect.

The behavior of failureUrl changes based on whether a custom loginPage is configured, while the behavior of failureHandler stays the same in either case.

When a custom login page is configured
http
	.formLogin((formLogin) -> formLogin
		.loginPage("/custom-login")
		.failureUrl("/failure")
	);

In this case, developers are required to process the specified URL ("/failure") to generate an error page.

When a custom login page is not configured
http
	.formLogin((formLogin) -> formLogin
		.failureUrl("/failure")
	);

In this case, the framework will process the specified URL ("/failure") and generate the default error page, which is simply the default login page with an error message.
If a developer has created a mapping for "/failure", it will be ignored.

This applies to formLogin, oauth2Login and saml2Login.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the AbstractAuthenticationFilterConfigurer.failureUrl(String) Javadoc and compare its statement with the two loginPage configurations described in the issue. Update the documentation to distinguish custom and default login pages and note that the behavior also applies to formLogin, oauth2Login, and saml2Login; done when the Javadoc accurately reflects these cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Documentation
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.