title: Rewrite spring-security redirect URLs
body: <p>I'm trying to get Tuckey UrlRewriteFilter to tidy up URLs for my webapp. One problem I've got is that when spring-security notices that an anonymous user is trying to access a protected resource it redirects to a URL which includes the servlet path.</p>
  
  <p>What I'd like is, by example:</p>
  
  <pre><code>&gt; GET http://localhost:8080/my-context/protected-resource
  &lt; Location: http://localhost:8080/my-context/login
  </code></pre>
  
  <p>What I currently get is:</p>
  
  <pre><code>&gt; GET http://localhost:8080/my-context/protected-resource
  &lt; Location: http://localhost:8080/my-context/-/login
  </code></pre>
  
  <p>Relevant documents I've found so far:</p>
  
  <p>DefaultRedirectStrategy, which does the actual redirect in question: <a href="http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/web/DefaultRedirectStrategy.html" rel="nofollow noreferrer">http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/web/DefaultRedirectStrategy.html</a>. It has a contextRelative property which is tempting but I don't think is going to cut it, if I can even find a way of configuring it.</p>
  
  <p>A blog post that helped get me this far: <a href="http://nonrepeatable.blogspot.com/2009/11/using-spring-security-with-tuckey.html" rel="nofollow noreferrer">http://nonrepeatable.blogspot.com/2009/11/using-spring-security-with-tuckey.html</a></p>
  
  <p>What I'd like to know is:</p>
  
  <ol>
  <li>Can/should I convince Tuckey to rewrite the Location header. &lt;outbound-rule&gt; doesn't seem to help any here.</li>
  <li>Can/should I somehow tweak the SS config to emit the rewritten URL. I don't think this is quite as tidy, as it'd break if rewrite was disabled.</li>
  </ol>
  
  <p><code>web.xml</code> looks like</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;UrlRewriteFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.tuckey.web.filters.urlrewrite.UrlRewriteFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;LogLevel&lt;/param-name&gt;
          &lt;param-value&gt;log4j&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;UrlRewriteFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
  &lt;/filter-mapping&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
      &lt;dispatcher&gt;FORWARD&lt;/dispatcher&gt;
      &lt;dispatcher&gt;INCLUDE&lt;/dispatcher&gt;
      &lt;dispatcher&gt;ERROR&lt;/dispatcher&gt;
  &lt;/filter-mapping&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;my-servlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;psms&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/-/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p><code>urlrewrite.xml</code> looks like:</p>
  
  <pre><code>&lt;urlrewrite&gt;
      &lt;rule&gt;
          &lt;from&gt;^/(.*)$&lt;/from&gt;
          &lt;to&gt;/-/$1&lt;/to&gt;
      &lt;/rule&gt;
  &lt;/urlrewrite&gt;
  </code></pre>
  
  <p><code>applicationContent-security.xml</code> looks like:</p>
  
  <pre><code>&lt;http auto-config="true"&gt;
      &lt;!-- allow GET requests to /login without authentication --&gt;
      &lt;intercept-url pattern="/-/login" method="GET" filters="none"/&gt;
  
      &lt;intercept-url pattern="/-/admin/**" access="ROLE_ADMIN"/&gt;
      &lt;intercept-url pattern="/-/**" access="ROLE_USER"/&gt;
  
      &lt;form-login login-page="/-/login"
                  login-processing-url="/-/login.do"
                  authentication-failure-url="/-/login?login_error"
                  default-target-url="/-/index"
                  always-use-default-target="true"/&gt;
  
      &lt;logout logout-url="/-/logout"
              logout-success-url="/-/login"/&gt;
  
      &lt;access-denied-handler error-page="/-/access-denied"/&gt;
  &lt;/http&gt;
  </code></pre>