From 15c96521fd0f1b3e272de337093050491b672bf7 Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Thu, 10 Apr 2008 16:50:28 +0000 Subject: [PATCH] Minor corrections to form-authentication.xml --- src/docbkx/form-authentication.xml | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/src/docbkx/form-authentication.xml b/src/docbkx/form-authentication.xml index 3fdf4b2974..21123eb637 100644 --- a/src/docbkx/form-authentication.xml +++ b/src/docbkx/form-authentication.xml @@ -7,19 +7,19 @@ HTTP Form Authentication involves using the AuthenticationProcessingFilter to process a login - form. This is the most common way that application authenticate end + form. This is the most common way for an application to authenticate end users. Form-based authentication is entirely compatible with the DAO and JAAS authentication providers. -
Configuration - +
+ Configuration The login form simply contains j_username and j_password input fields, and posts to a URL that is monitored by the filter (by default - j_spring_security_check). You should add an - AuthenticationProcessingFilter to you application context: + /j_spring_security_check). You should add an + AuthenticationProcessingFilter to your application context: @@ -44,14 +44,13 @@ SecurityContextHolder. Once the SecurityContextHolder has been - updated, the browser will need to be redirected to the target URL. The - target URL is usually indicated by the HttpSession - attribute specified by + updated, the browser will need to be redirected to the target URL which + is usually indicated by the HttpSession attribute stored under AbstractProcessingFilter.SPRING_SECURITY_TARGET_URL_KEY. This attribute is automatically set by the ExceptionTranslationFilter when an AuthenticationException occurs, so that after login - is completed the user can return to what they were trying to access. + is completed the user can return to what they were originally trying to access. If for some reason the HttpSession does not indicate the target URL, the browser will be redirected to the defaultTargetUrl property.