Using <error-page> in web.xml

[Mike Tabak]

I have a simple Spring security example using MySQL as the credential store. The application is working correctly in terms of authentication and authorization. I am running on the VmWare vFabric tc server inside Eclipse. When a user tries to access a page for which he does not have authorization I would like to direct him to a custom jsp, authfail.jsp. I tried to do this via the <error-page> tag in my web.xml file. When I try to access a page without proper authorization I get what appears to be a default error page titled "HTTP 403 Forbidden". This page has an i in a circle with the message: "The website declined to show this webpage", with some options that follow. I do not get my custom authfail.jsp page. However, if I run up the VmWare vFabric server from inside Eclipse, then access the URL from a web browser, I do get my custom page. Is there a way to get this page when accessing URLs from inside Eclipse? Thanks in advance

My web.xml is

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>/WEB-INF/spring/root-context.xml, 
		             /WEB-INF/spring/security-config.xml,
		             /WEB-INF/spring/datasource-tx.xml
		</param-value>
	</context-param>
	
	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>
            org.springframework.web.filter.DelegatingFilterProxy
        </filter-class>
    </filter>
    
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

	<servlet>
		<servlet-name>appServlet</servlet-name>
		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
		<init-param>
			<param-name>contextConfigLocation</param-name>
			<param-value>/WEB-INF/spring/appServlet/servlet-context.xml</param-value>
		</init-param>
		<load-on-startup>1</load-on-startup>
	</servlet>
		
	<servlet-mapping>
		<servlet-name>appServlet</servlet-name>
		<url-pattern>/</url-pattern>
	</servlet-mapping>
	
	<error-page>
	    <error-code>403</error-code>
	    <location>/WEB-INF/views/authfail.jsp</location>
	</error-page>

</web-app>

[Jayesh A Lalwani]

Can you post your spring xml. The 403 error might be returned from Spring

[Mike Tabak]

Jayesh A Lalwani wrote:Can you post your spring xml. The 403 error might be returned from Spring

I'm sure the error is being returned by Spring, I am trying to access a page I don't have authorization for. I'm just trying to show a custom jsp page in that case. Here is my spring security config:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:security="http://www.springframework.org/schema/security"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
		http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
		http://www.springframework.org/schema/security
		http://www.springframework.org/schema/security/spring-security-3.1.xsd">
		

	   <security:http auto-config="true" >
	       
	       <security:intercept-url pattern="/welcome" access="ROLE_ADMIN"/>
	       
	       <security:form-login login-page="/login" default-target-url="/welcome"
	           		                              authentication-failure-url="/loginfailed" />
	       <security:logout logout-success-url="/logout" />
	       
	   </security:http>
	   	  
	   <!-- id="authenticationManager" -->
       <security:authentication-manager>
           <security:authentication-provider>
               <security:jdbc-user-service data-source-ref="dataSource"
                   users-by-username-query="
                        select username, password, enabled 
     				    from users where username=?"
     			   authorities-by-username-query="
     			        select u.username, ur.authority from users u, user_roles ur
     			        where u.user_id = ur.user_id and u.username =?  "
     		   />
           </security:authentication-provider>
       </security:authentication-manager>
       
</beans>

Here is my servlet context:

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/mvc"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:context="http://www.springframework.org/schema/context"
	xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
	
	<annotation-driven />
	<context:component-scan base-package="com.mykong.security" />
	
	<resources mapping="/resources/**" location="/resources/" />

	<beans:bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
		<beans:property name="prefix" value="/WEB-INF/views/" />
		<beans:property name="suffix" value=".jsp" />
	</beans:bean>

	<beans:bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource">
	    <beans:property name="basenames">
	        <beans:list>
	            <beans:value>mymessage</beans:value>
	        </beans:list>
	    </beans:property>
	</beans:bean>
	
</beans:beans>

I won't post datasource-tx.xml as this contains only database configs and I have verified by turning on debug that I am accessing the database without issues. Also there is nothing in my
root-context.xml