title: Spring security fail in load balanced (AWS Beanstalk) environment?
body: <p>I am working on an existing code that's working just fine in an existing environment. The application has a login form that takes user to a landing page after they login.</p>
  
  <p>My problem: When I moved the application to AWS Beanstalk (with 2 instances), successful login brings the user back to the login page</p>
  
  <p>The application is Spring-based (MVC, Security), with the following configuration for security:</p>
  
  <pre><code>&lt;security:http use-expressions="true"&gt;
      &lt;security:intercept-url pattern="/" access="permitAll" /&gt;
      &lt;security:intercept-url pattern="/index.html" access="permitAll" /&gt;
      &lt;security:intercept-url pattern="/login.html" access="permitAll" /&gt;
  
      ... bunch of other pages ....
  
      &lt;security:intercept-url pattern="/secure/**" access="isAuthenticated()" /&gt;
  
  
      &lt;security:form-login login-page="/login.html"
          default-target-url="/secure/landing.html"
          authentication-failure-url="/login.html?login_error=1" /&gt;
  
      &lt;security:logout logout-url="/logout.html"
          logout-success-url="/login.html" /&gt;
  &lt;/security:http&gt;
  </code></pre>
  
  <p>The application is working fine in a single node environment, example log trace when user logs in:</p>
  
  <blockquote>
    <p><strong>1:</strong> [http-bio-8080-exec-1  DEBUG DefaultRedirectStrategy - sendRedirect - Redirecting to '/myapp/secure/landing.html'</p>
    
    <p><strong>2:</strong> [http-bio-8080-exec-1]  DEBUG HttpSessionSecurityContextRepository - saveContext - SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl@86073c69: /* some details */ Granted Authorities: ROLE_USER'</p>
    
    <p><strong>3:</strong> [http-bio-8080-exec-1] DEBUG SecurityContextPersistenceFilter - doFilter - SecurityContextHolder now cleared, as request processing completed</p>
    
    <p><strong>4:</strong> [http-bio-8080-exec-1] DEBUG AntPathRequestMatcher - matches - Checking match of request : '/secure/landing.html'; against '/resources/**'</p>
  </blockquote>
  
  <p>When this application (we took the exact same war file) into AWS Beanstalk environment, configured with 2 instances, this is what happen:</p>
  
  <blockquote>
    <p><strong>1:</strong> [http-bio-8080-exec-7] DEBUG DefaultRedirectStrategy - sendRedirect - Redirecting to '/secure/landing.html'</p>
    
    <p><strong>2:</strong> [http-bio-8080-exec-7] DEBUG HttpSessionSecurityContextRepository - createNewSessionIfAllowed - HttpSession being created as SecurityContext is non-default </p>
    
    <p><strong>3:</strong> [http-bio-8080-exec-7] DEBUG HttpSessionSecurityContextRepository - saveContext - SecurityContext stored to HttpSession: 
    'org.springframework.security.core.context.SecurityContextImpl@a3421210: /* some details */ Granted Authorities: ROLE_USER'</p>
    
    <p><strong>4:</strong> [http-bio-8080-exec-7] DEBUG SecurityContextPersistenceFilter - doFilter - SecurityContextHolder now cleared, as request processing completed</p>
    
    <p><strong>5:</strong> [http-bio-8080-exec-9] DEBUG AntPathRequestMatcher - matches - Checking match of request : '/login.html'; against '/resources/**'</p>
  </blockquote>
  
  <p>Line-by-line comparison:</p>
  
  <ul>
  <li>The AWS log has 1 extra line, line 2</li>
  <li>The AWS log shows thread change from exec-7 to exec-9 in the last line, line 5 (and hence it loses the original request redirection and replace it back to /login.html rather than /secure/landing.html)</li>
  </ul>
  
  <p>To get around the problem that's going on in AWS, re-configuring beanstalk to only work with 1 instance seems to hide the problem away.</p>
  
  <p>Any idea what's missing from the configuration that fails in a multi node environment?</p>