title: Spring security + sendRedirect not working
body: <p>Currently my spring-security.xml looks like this:</p>
  
  <pre><code>&lt;global-method-security pre-post-annotations="enabled" /&gt;
  
      &lt;http pattern="/login" security="none"/&gt;
      &lt;http pattern="/assets/**" security="none"/&gt;
  
      &lt;http auto-config="false" entry-point-ref="authenticationEntryPoint" disable-url-rewriting="true"&gt;
          &lt;intercept-url pattern="/**" access="ROLE_USER"/&gt;
          &lt;intercept-url pattern="/admin/**" access="ROLE_ADMIN"/&gt;
          &lt;intercept-url pattern="/tadmin/**" access="ROLE_TENANT_ADMIN"/&gt;
          &lt;form-login login-page="/login" authentication-success-handler-ref="authenticationSuccessHandler" authentication-failure-url="/login?error"/&gt;
          &lt;logout logout-url="/logout" logout-success-url="/login"/&gt;
          &lt;remember-me/&gt;
      &lt;/http&gt;
  
      &lt;beans:bean id="authenticationSuccessHandler" class="com.dj.LoginSuccessHandler"&gt;
          &lt;beans:property name="useReferer" value="true"/&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="authenticationEntryPoint"
          class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"&gt;
          &lt;beans:property name="loginFormUrl" value="/login" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;authentication-manager alias="authenticationManager"&gt;
          &lt;authentication-provider&gt;
              &lt;!-- &lt;password-encoder hash="md5"/&gt; --&gt;
              &lt;user-service&gt;
                  &lt;user name="user" password="123" authorities="ROLE_USER"/&gt;
                  &lt;user name="admin" password="123" authorities="ROLE_ADMIN,ROLE_USER"/&gt;
                  &lt;user name="tadmin" password="123" authorities="ROLE_TENANT_ADMIN,ROLE_USER"/&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>My custom AuthenticationSuccessHandler:</p>
  
  <pre><code>package com.dj;
  
  import java.io.IOException;
  
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  
  import org.springframework.security.core.Authentication;
  import org.springframework.security.core.GrantedAuthority;
  import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
  
  import com.dj.UserRole;
  
  public class LoginSuccessHandler extends
      SavedRequestAwareAuthenticationSuccessHandler {
      // getters and setters for injected services
  
      @Override
      public void onAuthenticationSuccess(HttpServletRequest request,
          HttpServletResponse response, Authentication authentication) {
  
      try {
          String redirectUrl = "/login";
          if (hasRole(authentication, UserRole.ROLE_ADMIN)) {
          redirectUrl = "/app/admin/secure";
          } else if (hasRole(authentication, UserRole.ROLE_TENANT_ADMIN)) {
          redirectUrl = "/app/tadmin/secure";
          } else if (hasRole(authentication, UserRole.ROLE_USER)) {
          redirectUrl = "/app/USER/";
          }
          response.sendRedirect(redirectUrl);
      } catch (IOException e) {
          // TODO Auto-generated catch block
          e.printStackTrace();
      }
      }
  
      /**
       * Check if a role is present in the authorities of current user
       * 
       * @param authorities
       *            all authorities assigned to current user
       * @param role
       *            required authority
       * @return true if role is present in list of authorities assigned to
       *         current user, false otherwise
       */
      private boolean hasRole(Authentication auth, UserRole role) {
      boolean hasRole = false;
      for (GrantedAuthority grantedAuthority : auth.getAuthorities()) {
          hasRole = grantedAuthority.getAuthority().equals(role.name());
          if (hasRole)
          break;
      }
      return hasRole;
      }
  }
  </code></pre>
  
  <p>When I try to log in i can see by intercepting network traffic:</p>
  
  <ol>
  <li>A POST from my custom login form sending username,password,remember me to <code>j_spring_security_check</code></li>
  <li>A GET from the app/admin/secure page</li>
  </ol>
  
  <p>However, I am never getting redirected to the correct page given the type of user that has just been logged in, stuck forever on the login page.</p>
  
  <p>When entering the redirect url manually everything works fine and I am logged in properly.
  Seems to me security is set up properly, however the redirecting is just not working.</p>
  
  <p>Any help on this matter would be appreciated.</p>