Spring security remember me giving the error: ERR_TOO_MANY_REDIRECTS

I have recently implemented the Spring Security Token based remember me functionality in my Java Spring MVC web application. My spring-security.xml fie is as follows:

Spring Security Token based remember me

Java Spring MVC web application

<http auto-config="true" use-expressions="true">
<intercept-url pattern="/login**" access="permitAll" />
<intercept-url pattern="/layout/**" access="permitAll" />
<intercept-url pattern="/min/**" access="permitAll" />
<intercept-url pattern="/rest/v3/**" access="permitAll" />
<intercept-url pattern="/password/**" access="permitAll" />
<intercept-url pattern="/register/**" access="permitAll" />
<intercept-url pattern="/unsubscribe/**" access="permitAll" />
<intercept-url pattern="/**" access="isFullyAuthenticated()"/>

<form-login login-page="/login" default-target-url="/"
authentication-failure-url="/login?error" username-parameter="username"
password-parameter="password" />
<logout logout-success-url="/login?logout" invalidate-session="false" />

<!-- enable csrf protection
<csrf />
-->
<!-- access denied page -->
<access-denied-handler error-page="/403" />

<logout delete-cookies="JSESSIONID"/>
<remember-me key="myAppKey" />

</http>


After implementing this feature, the remember me function is working. But I am getting an error as follows:

I have tried to add the permitAll() option to the login `URL' as understood from some docs. But nothing seems to be working for me. The same configuration is working for me in all my other web applications.

permitAll()

permitAll()

2 Answers
2

Try changing

<intercept-url pattern="/login**" access="permitAll" />


TO

<intercept-url pattern="/login" access="permitAll" />


You actually don't need permission to a login page:

Outside your http tag, add this

http tag

<http security="none" pattern="/login" />


and remove

<intercept-url pattern="/login**" access="permitAll" />


This applies for those cases you wanna load css/js files too

Your file will look like this, for example:

<http security="none" pattern="/login" />
<http security="none" pattern="/layout/**" />
<http security="none" pattern="/min/**" />

<http auto-config="true" use-expressions="true">

<intercept-url pattern="/rest/v3/**" access="permitAll" />
<intercept-url pattern="/password/**" access="permitAll" />
<intercept-url pattern="/register/**" access="permitAll" />
<intercept-url pattern="/unsubscribe/**" access="permitAll" />
<intercept-url pattern="/**" access="isFullyAuthenticated()"/>

<form-login login-page="/login" default-target-url="/"
authentication-failure-url="/login?error" username-parameter="username"
password-parameter="password" />
<logout logout-success-url="/login?logout" invalidate-session="false" />

<!-- enable csrf protection
<csrf />
-->
<!-- access denied page -->
<access-denied-handler error-page="/403" />

<logout delete-cookies="JSESSIONID"/>
<remember-me key="myAppKey" />

</http>


Reference Spring Security documentation: https://docs.spring.io/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#ns-minimal

3.2.3 Form and Basic Login Options

Note that you can still use auto-config. The form-login element just overrides the default settings. Also note that we've added an extra intercept-url element to say that any requests for the login page should be available to anonymous users [5]. Otherwise the request would be matched by the pattern /** and it wouldn't be possible to access the login page itself! This is a common configuration error and will result in an infinite loop in the application. Spring Security will emit a warning in the log if your login page appears to be secured. It is also possible to have all requests matching a particular pattern bypass the security filter chain completely, by defining a separate http element for the pattern like this:

Thanks for contributing an answer to Stack Overflow!

But avoid …

To learn more, see our tips on writing great answers.

Required, but never shown

Required, but never shown

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.