title: Spring MVC + Spring Security - Controller Authentication using JSON
body: <p>I'd like to use simple Spring controller to authenticate the Users using Spring Security.</p>
  
  <p>My Controller</p>
  
  <pre><code>@Controller
  @Scope("request")
  public class Authenticator {
  
  private String username;
  private String password;
  
  @Autowired
  private AuthenticationManager authenticationManager;
  
  @RequestMapping(value = "/login", method = {RequestMethod.POST })
  public @ResponseBody String authentication(@RequestParam("login") String userName,
          @RequestParam("password") String password, HttpServletRequest request) {
  
      this.username = userName;
      this.password = password;
  
      Authentication authenticationToken = new UsernamePasswordAuthenticationToken(
              userName, password);
      try {
  
          Authentication authentication = authenticationManager
                  .authenticate(authenticationToken);
  
  
          SecurityContext securityContext = SecurityContextHolder
                  .getContext();
  
          securityContext.setAuthentication(authentication);
  
          HttpSession session = request.getSession(true);
          session.setAttribute("SPRING_SECURITY_CONTEXT", securityContext);
  
          return "sucess";
      } catch (AuthenticationException ex) {
          return "fail " + ex.getMessage();
      }
  
  }
  </code></pre>
  
  <p>My spring-security.xml</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
  http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
  
  &lt;http pattern="/resources/**" security="none" /&gt;
  
  &lt;http auto-config="true" use-expressions="true"&gt;
      &lt;intercept-url pattern="/login" access="permitAll" /&gt;
  
      &lt;intercept-url pattern="/logout" access="permitAll" /&gt;
  
      &lt;intercept-url pattern="/accessdenied" access="permitAll" /&gt;
  
      &lt;intercept-url pattern="/**" access="hasRole('ROLE_USER')" /&gt;
  
      &lt;form-login /&gt;
  
      &lt;logout logout-success-url="/logout" /&gt;
  
  
      &lt;!-- &lt;session-management invalid-session-url="/loginlimmit"&gt;
          &lt;concurrency-control error-if-maximum-exceeded="true"
              max-sessions="1" /&gt;
      &lt;/session-management&gt; --&gt;
  
  &lt;/http&gt;
  
  &lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
  
          &lt;user-service&gt;
              &lt;user name="a" password="a" authorities="ROLE_USER" /&gt;
          &lt;/user-service&gt;
  
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p></p>
  
  <p>This works fine </p>
  
  <p>1 - if I try to access http: //localhost/app is redirect to http: //localhost/app/spring_security_login to login as expected</p>
  
  <p>2 - if I send POST method to http: //localhost/app/login works, I receive the message sucess or fail as expected using credentials username=a and password=a as defined in Spring-security.xml in authentication provider, so it really authenticate using spring .security.</p>
  
  <p><strong>The problems</strong></p>
  
  <p>After send POST method and get login sucess, if I try to acess http: //localhost/app is redirect to http: //localhost/app/spring_security_login , so I cant undestand beacause the authentication worked fine!</p>
  
  <p>How can get User authenticated in others controllers? </p>
  
  <p>My goals is develop an application with Spring MVC but I will not use as standard web application, it will works like Backend application and the frontend will be other application, such as desktop, mobile, vaadin framework and these application will comunicate using JSON, the Spring MVC works fine to  this, but I need to implement the authentication, in this case, using Spring Security.</p>
  
  <p>any hep?</p>