Spring-MVC & Security-Test-Application
With Spring security & Spring MVC working on authentication, authorization [csrf].
Login :
Application starting with custom login page (not Spring login page) with name 'login.jsp' and 'spring-security.xml' will handle the authentication op. with checking 'username & password' from database[go to below] if the user found will send the url to 'default-target-url="/hello"' else 'authentication-failure-url="/login?error=true" ' thats mean 'spring-security.xml' will redirect the user to 'login' page with message in 'sessionScope['SPRING_SECURITY_LAST_EXCEPTION'].message' while login op. end successfully.
Log out :
When user pressing 'Logout' button application will send the user to '/j_spring_security_logout' with hidden '${_csrf.parameterName}' and '${_csrf.token}' in POST method because _csrf need to invalidate session with spessific UID and '@Controller'[SecurityController] page will handle it and will log it out. Than will redirect the user to 'login' page again.
Access denied :
All users have some role like 'ROLE_USER' or 'ROLE_ADMIN' we need to prevent all users to access 'admin' page or panel to do this we have to add some intercept-urls in 'spring-security.xml' than Spring will work as we want and when the user that doesn't have permission to view private pages will redirect to 'Spring default access denied page' Example : just ROLE_ADMIN can access this page. So to create custom access denied page and redirect to user to it we have to add 'error-page' to 'web.xml' and add this line to 'spring-security.xml' than handle this url in '@Controller' [SecurityController] page.
Database connection and injecting to security.xml :
If we use xml configuration with Spring we have to set all connection configurations in 'spring-config.xml'. We alredy created our connection properties with 'id="dataSource"' and as like we said above 'spring-security.xml' need to check the username and password from database thats why we will give this connection to 'spring-security.xml' with this line : '' than we need to add connection id in tag jdbc-user-service like this : and Spring will use this connection.
Note :
We also can use default Spring login page, default access denied page or without connection to database like : Spring Security Annotation Example | Spring Security without db connection Example
I hope this help you.