Why redirect script downloads page instead of redirecting?

[Molayo Decker]

My redirect Authentication method is supposed to redirect to a page specified in the select option value but instead it downloads a file named login.

i am confused where to use getQueryString or request.getRequestDispathcer("requestUrl").forward(request, response)[Reference][2].

I also do not understand why it keeps downloading a file named login.

Login Page

   

<form class="myform" th:action="@{/login}" th:object="${user}" method="post">
            <div th:replace="common/layout :: flash"></div>
            <div class="form-group">
                <select th:field="*{cert}" class="form-control input-lg" id="selectEl" >
                     <option value="#">Select a location</option>
    <option value="location.htm">Location</option>
    <option value="other.htm">Other</option>
                </select>
            </div>
            <div>
                <div class="input-group input-group-lg">
                    <span class="input-group-addon" id="sizing-addon1">@</span>
                    <input type="text" class="form-control" placeholder="LoginID" th:field="*{username}" aria-describedby="sizing-addon1" />
                </div>
            </div>
               <div class="form-group">
                <div class="input-group input-group-lg">
                    <span class="input-group-addon form-wrapper" id="sizing-addon2">@</span>
                    <input type="password" class="form-control showpassword" placeholder="Pin" th:field="*{password}"  aria-describedby="sizing-addon1"  />
                    <span class="input-group-btn">
                    <button class="btn btn-default toggle" type="button">Show Pin</button>
                    </span>
                </div>
            </div>
            <div>
                <label>
                    <input type="checkbox" value="1" id="checkbox" /> <p class="login-caution">I have carefully read all instructions as well as programme requirements in the Admission Brochure and i here my accept any responsibility for any omission(s) or error(s) on my submitted form.</p>
                </label>
            </div>
            <button type="submit" id="btnCheck" class="btn btn-primary btn-lg btn-block">Login</button>
        </form>

Login Controller

 

 @RequestMapping(path = "/login", method = RequestMethod.GET)
        public String loginForm(Model model, HttpServletRequest request) {
            model.addAttribute("user", new User());
            if (request != null) {
                DefaultSavedRequest savedRequest=(DefaultSavedRequest) request.getSession().getAttribute("SPRING_SECURITY_SAVED_REQUEST_KEY");
                if (savedRequest != null) {
                    model.addAttribute("redirectUrl", savedRequest.getRedirectUrl());
                    return savedRequest.getRedirectUrl();
                }
            }
            model.addAttribute("programs", Program.values());
            try {
                Object flash = request.getSession().getAttribute("flash");
                model.addAttribute("flash", flash);
    
                request.getSession().removeAttribute("flash");
            } catch (Exception ex) {
                // "flash" session attribute must not exist...do nothing and proceed normally
            }
           return "login";
        }

Security Config

   

 @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .authorizeRequests()
                        .anyRequest().hasRole("USER")
                        .and()
                    .formLogin()
                        .loginPage("/login")
                        .permitAll()
                        .successHandler(loginSuccessHandler())
                        .failureHandler(loginFailureHandler())
                        .and()
                    .logout()
                    .permitAll()
                    .logoutSuccessUrl("/login").deleteCookies("JSESSIONID").logoutSuccessUrl("/");
        }
    
       public AuthenticationSuccessHandler loginSuccessHandler() {
        return (request, response, authentication)-> {
            String queryString = request.getQueryString();
            if(queryString == null) {
                response.setStatus(200);
            } else if(!queryString.contains("redirectUrl")) {
                response.sendRedirect("/");
            } else {
                queryString = URLDecoder.decode(queryString, "utf-8");
                response.sendRedirect(queryString);
            }
        };
    }
    
        public AuthenticationFailureHandler loginFailureHandler() {
            return (request, response, exception) -> {
                request.getSession().setAttribute("flash", new FlashMessage("Incorrect username and/or password. Please try again.", FlashMessage.Status.FAILURE));
                //request.removeAttribute("username");
                response.sendRedirect("/login");
            };
        }
    
        @Bean
        public EvaluationContextExtension securityExtension(){
            return new EvaluationContextExtensionSupport() {
                @Override
                public String getExtensionId() {
                    return "security";
                }
    
                @Override
                public Object getRootObject() {
                    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
                    return new SecurityExpressionRoot(authentication) {};
                }
            };
        }

 [1]: http://stackoverflow.com/questions/42520877/how-to-redirect-to-requested-page-after-login-in-spring/42521057#42521057
 [2]: http://stackoverflow.com/questions/20371220/what-is-the-difference-between-response-sendredirect-and-request-getrequestdis