title: Spring security custom login form redirecting to resource not available
body: <p>I am new to Spring security 4. I have made a simple application with struts 2 and spring security. I am using custom login form. What happening is when I submit the login form I get redirected to <a href="http://localhost:8080/SpringSecurity/admin" rel="nofollow noreferrer">http://localhost:8080/SpringSecurity/admin</a> but still I get the below error </p>
  
  <p><strong>HTTP Status 404 - /SpringSecurity/admin</strong></p>
  
  <p><strong>type Status report</strong></p>
  
  <p><strong>message /SpringSecurity/admin</strong></p>
  
  <p><strong>description The requested resource is not available.</strong></p>
  
  <p>login.jsp</p>
  
  <pre><code>&lt;%@ page language="java" contentType="text/html; charset=ISO-8859-1"
      pageEncoding="ISO-8859-1"%&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"&gt;
  &lt;title&gt;Insert title here&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
      &lt;form action="admin" method="post"&gt;
          &lt;label&gt;Username&lt;/label&gt;&lt;input type="text" id="username" name="username" /&gt; &lt;label&gt;Password&lt;/label&gt;&lt;input
              type="text" id="password" name="password" /&gt; &lt;input name="submit" type="submit" /&gt;
      &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>admin.jsp</p>
  
  <pre><code>&lt;%@ page language="java" contentType="text/html; charset=ISO-8859-1"
      pageEncoding="ISO-8859-1"%&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"&gt;
  &lt;title&gt;Insert title here&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  HELLO
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-4.1.xsd"&gt;
      &lt;http use-expressions="true"&gt;
      &lt;csrf disabled="true"/&gt;
          &lt;intercept-url pattern="/login" access="permitAll"/&gt;
          &lt;intercept-url pattern="/admin" access="hasRole('ROLE_USER')" /&gt; 
          &lt;form-login login-page="/login" authentication-failure-url="/error" login-processing-url="/admin" authentication-success-forward-url="/admin" /&gt;
      &lt;/http&gt;
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;   
              &lt;user-service&gt;
                  &lt;user name="mayank" password="mayank" authorities="ROLE_USER"   /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="WebApp_ID" version="3.0"&gt;
    &lt;display-name&gt;SpringSecurity&lt;/display-name&gt;
    &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;index.html&lt;/welcome-file&gt;
      &lt;welcome-file&gt;index.htm&lt;/welcome-file&gt;
      &lt;welcome-file&gt;login.jsp&lt;/welcome-file&gt;
      &lt;welcome-file&gt;default.html&lt;/welcome-file&gt;
      &lt;welcome-file&gt;default.htm&lt;/welcome-file&gt;
      &lt;welcome-file&gt;default.jsp&lt;/welcome-file&gt;
    &lt;/welcome-file-list&gt;
    &lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;/WEB-INF/spring-security.xml&lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
    &lt;/filter&gt;
    &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
    &lt;filter&gt;
    &lt;filter-name&gt;struts2&lt;/filter-name&gt;
    &lt;filter-class&gt;org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter&lt;/filter-class&gt;
    &lt;/filter&gt;
    &lt;filter-mapping&gt;
    &lt;filter-name&gt;struts2&lt;/filter-name&gt;
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
    &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
    &lt;/listener&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>struts.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE struts PUBLIC
  "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
  "http://struts.apache.org/dtds/struts-2.3.dtd"&gt;
  &lt;struts&gt;
      &lt;package name="default" namespace="/" extends="struts-default"&gt;
          &lt;action name="admin" class="controller.AdminController"
              method="execute"&gt;
              &lt;result name="success"&gt;/WEB-INF/admin.jsp&lt;/result&gt;
          &lt;/action&gt;
          &lt;action name="login"&gt;
              &lt;result&gt;/WEB-INF/login.jsp&lt;/result&gt;
          &lt;/action&gt;
          &lt;action name="error"&gt;
          &lt;result&gt;/WEB-INF/error.jsp&lt;/result&gt;
          &lt;/action&gt;
      &lt;/package&gt;
  &lt;/struts&gt;
  </code></pre>
  
  <p>AdminController</p>
  
  <pre><code>public class AdminController extends HttpServlet {
  
      private String username;
      private String password;
  
      public String execute(){
          System.out.println(getUsername()+" "+getPassword());
          return "success";
      }
      public String getUsername() {
          return username;
      }
      public void setUsername(String username) {
          this.username = username;
      }
      public String getPassword() {
          return password;
      }
      public void setPassword(String password) {
          this.password = password;
      }
  }
  </code></pre>
  
  <p>Below is the Stack trace. I see</p>
  
  <pre><code>- /admin at position 1 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  - Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl@fb929c69: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@fb929c69: Principal: org.springframework.security.core.userdetails.User@bf8f9e59: Username: mayank; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@0: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 89A6B91ADDB34C56892BA52AABFFFB38; Granted Authorities: ROLE_USER'
  - /admin at position 2 of 10 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
  - /admin at position 3 of 10 in additional filter chain; firing Filter: 'HeaderWriterFilter'
  - /admin at position 4 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
  - Checking match of request : '/admin'; against '/admin'
  - Request is to process authentication
  - Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
  - Delegating to org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy@51602eeb
  - Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@fb929c69: Principal: org.springframework.security.core.userdetails.User@bf8f9e59: Username: mayank; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@0: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: CCF2FB776A4077BCCD71705E9A2CEAEF; Granted Authorities: ROLE_USER
  - Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@60539cb2
  - SecurityContext 'org.springframework.security.core.context.SecurityContextImpl@fb929c69: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@fb929c69: Principal: org.springframework.security.core.userdetails.User@bf8f9e59: Username: mayank; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@0: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: CCF2FB776A4077BCCD71705E9A2CEAEF; Granted Authorities: ROLE_USER' stored to HttpSession: 'org.apache.catalina.session.StandardSessionFacade@3c23a642
  - SecurityContextHolder now cleared, as request processing completed
  </code></pre>