title: Spring security and multiple log in forms
body: <p>I have a web application using spring security in order to manage authentication.
  My client has 2 login forms, my spring security config is as follows:</p>
  
  <pre><code>&lt;http auto-config="true" use-expressions="true" create-session="always"&gt;
          &lt;intercept-url pattern="/**"  access="permitAll" /&gt;
  
          &lt;form-login login-processing-url="/user/login" login-page="/user/login/unauthorized" 
              default-target-url="/user/firstLogin" authentication-failure-url="/user/login/failure" /&gt;
  
          &lt;form-login login-processing-url="/user/relogin" login-page="/user/login/unauthorized" 
              default-target-url="/user/reLoginFromClient" authentication-failure-url="/user/login/failure" /&gt;
  
          &lt;logout logout-url="/user/logout/spring" logout-success-url="/user/logout/success" /&gt;
          &lt;access-denied-handler ref="accessDeniedHandler"/&gt;
      &lt;/http&gt;
  </code></pre>
  
  <p>The first form-login element works fine i.e. i am able to login from the <code>/user/login</code> URL.
  However, when i try to login from the second url <code>/user/relogin</code>, i get a 415:unsupported media type response from the server.</p>
  
  <p>Note that if i switch the two  elements, the one that is on top works fine and the bottom one results in a 415 response.</p>
  
  <p>I did as suggested in the selected answer, my configuration now looks like this:</p>
  
  <pre><code>&lt;http auto-config="true" use-expressions="true" create-session="always" authentication-manager-ref="authenticationManager"&gt;
          &lt;intercept-url pattern="/**"  access="permitAll" /&gt;
          &lt;custom-filter after="SECURITY_CONTEXT_FILTER" ref="reLoginFilter"/&gt;
          &lt;form-login login-processing-url="/user/login" login-page="/user/login/unauthorized" 
              default-target-url="/user/firstLogin" authentication-failure-url="/user/login/failure" /&gt;
          &lt;logout logout-url="/user/logout/spring" logout-success-url="/user/logout/success" /&gt;
          &lt;access-denied-handler ref="accessDeniedHandler"/&gt;  
      &lt;/http&gt;
  
      &lt;beans:bean id="reLoginFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"&gt;
          &lt;beans:property name="authenticationManager" ref="authenticationManager"/&gt;
          &lt;beans:property name="filterProcessesUrl" value="/user/relogin"/&gt;
          &lt;beans:property name="authenticationSuccessHandler" ref="authenticationSuccessHandler" /&gt;
          &lt;beans:property name="authenticationFailureHandler" ref="authenticationFailHandler" /&gt;
      &lt;/beans:bean&gt; 
  
      &lt;beans:bean id="authenticationSuccessHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"&gt;
          &lt;beans:property name="defaultTargetUrl" value="/user/relogin/success"/&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="authenticationFailHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"&gt;
          &lt;beans:property name="defaultFailureUrl" value="/user/login/failure"/&gt;
      &lt;/beans:bean&gt;
  </code></pre>