Spring Security 404 While Redirecting To Login Page

[AgustinC Cardeilhac Banus]

I would like to give my current project code:

Current Spring Security Config

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                   .authorizeRequests()
                        .mvcMatchers("/history").hasAuthority("EMPLOYEE")
                        .mvcMatchers("/home").hasAuthority("EMPLOYEE")
                        .mvcMatchers("/live").hasAuthority("EMPLOYEE")
                        .mvcMatchers("/management").hasAnyAuthority("ADMIN")
                        .mvcMatchers("/preferences").hasAuthority("EMPLOYEE")
                        .mvcMatchers("/api/**").hasAuthority("EMPLOYEE")
            .anyRequest().authenticated()
        .and()
            .formLogin()
                .loginPage("/login").permitAll()
                .loginProcessingUrl("/login").permitAll()
                .defaultSuccessUrl("/home", true)
                .usernameParameter("username")
                .passwordParameter("password")
                .failureHandler(new CustomAuthenticationFailureHandler());

    }

Current Controller:

@Controller
public class AppController {

    @GetMapping(value = {"/login"})
    public ModelAndView login() {
        return new ModelAndView("form");
    }

    @GetMapping(value = {"/history"})
    public ModelAndView history() {
        return new ModelAndView("history");
    }

    @GetMapping(value = {"/home"})
    public ModelAndView home() {
        return new ModelAndView("home");
    }

    @GetMapping(value = {"/live"})
    public ModelAndView live() {
        return new ModelAndView("live");
    }

    @GetMapping(value = {"/management"})
    public ModelAndView management() {
        return new ModelAndView("management");
    }

    @GetMapping(value = {"/preferences"})
    public ModelAndView preferences() {
        return new ModelAndView("preferences");
    }

}

I expect that, if I  am not authenticated and I hit localhost:1111/preferences, I am redirected to localhost:1111/login. This happens but the screen shows a 404 !... what could be happening ?...

[Stephan van Hulst]

When you disable your security config and browse to /preferences, do you also get a 404 or is your preferences page shown?

What kind of Spring application are you building? Are you using Spring boot? Please show us your application configuration.

[AgustinC Cardeilhac Banus]

This is a psring boot application. When I browse to /preferences, I am redirected to /login but the page shown is a 404 page.

<?xml version="1.0" encoding="UTF-8"?> <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"> <modelVersion>4.0.0</modelVersion> <parent> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-parent</artifactId> <version>2.4.2</version> <relativePath/> <!-- lookup parent from repository --> </parent> <groupId>com.scorecard.event</groupId> <artifactId>generator</artifactId> <version>0.0.1-SNAPSHOT</version> <name>generator</name> <description>Dummy Event Generator</description> <properties> <java.version>1.8</java.version> <mongodb-driver.version>4.0.5</mongodb-driver.version> <mongodb-reactivestreams.version>4.1.0</mongodb-reactivestreams.version> <querydsl.version>4.3.1</querydsl.version> </properties> <dependencies> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency> <dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-stream-rabbit</artifactId> <version>3.0.10.RELEASE</version> </dependency> <dependency> <groupId>org.apache.tomcat.embed</groupId> <artifactId>tomcat-embed-jasper</artifactId> <scope>provided</scope> </dependency> <dependency> <groupId>javax.servlet</groupId> <artifactId>jstl</artifactId> </dependency> <dependency> <groupId>org.json</groupId> <artifactId>json</artifactId> <version>20210307</version> </dependency> <dependency> <groupId>commons-io</groupId> <artifactId>commons-io</artifactId> <version>2.8.0</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-websocket</artifactId> <version>5.2.2.RELEASE</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-data-mongodb</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> </dependencies> <build> <plugins> <plugin> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-maven-plugin</artifactId> </plugin> </plugins> </build> </project>

[AgustinC Cardeilhac Banus]

Here is a small video I made... 404 Login Page
The /preferences is not shown...

[Stephan van Hulst]

What I meant was, what happens when you DON'T require authorization on the /preferences URL?

Can you show us your SpringBootApplication?

Please also tell us what package your application class and your controller class are in.

[AgustinC Cardeilhac Banus]

I know where you are going... If I remove the "haveAuthority" from the /preferences and apply a permitAll, I get a 404... Then you could be thinking.. The controllear beant maybe be not included inside the app context but I double checked and it seems fine for me:
Project Structure
I must be missing something really silly...
Another thing, I made a void method annotated with @PostCOnstruct and debug, and the execution went in... So I guess its included !

[AgustinC Cardeilhac Banus]

I added a logging into the DispatcherServlet and it shows this:
2021-03-22 09:32:51.219  INFO 44377 --- [nio-1111-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet' 2021-03-22 09:32:51.219  INFO 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet' 2021-03-22 09:32:51.219 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : Detected StandardServletMultipartResolver 2021-03-22 09:32:51.219 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : Detected AcceptHeaderLocaleResolver 2021-03-22 09:32:51.219 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : Detected FixedThemeResolver 2021-03-22 09:32:51.220 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : Detected org.springframework.web.servlet.view.DefaultRequestToViewNameTranslator@709d86a2 2021-03-22 09:32:51.220 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : Detected org.springframework.web.servlet.support.SessionFlashMapManager@78288f83 2021-03-22 09:32:51.220 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : enableLoggingRequestDetails='false': request parameters and headers will be masked to prevent unsafe logging of potentially sensitive data 2021-03-22 09:32:51.220  INFO 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms 2021-03-22 09:32:51.238 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : "FORWARD" dispatch for GET "/", parameters={} 2021-03-22 09:32:51.245 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : Exiting from "FORWARD" dispatch, status 404 2021-03-22 09:32:51.247 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : "ERROR" dispatch for GET "/error", parameters={} 2021-03-22 09:32:51.268 DEBUG 44377 --- [nio-1111-exec-1] o.s.web.servlet.DispatcherServlet        : Exiting from "ERROR" dispatch, status 404

I added this iside the controller:

    @GetMapping(value = {"/"})
    public RedirectView root() {
        return new RedirectView("form");
    }

This is because I saw the app was requesting a "/" (dont know why) and there was a handler for that. When I hit /preferences, instead of redirecting to /login it stays in /preferences but it show the "form" view (Which has the login form). When I try to login with good credentials, it redirects to /home but the page shown is the same as the login form. I am kinda lost...

[AgustinC Cardeilhac Banus]

If you want, we can make a google meet... I would really appreciate !