title: How to avoid Spring Security redirect loop when using custom form login?
body: <h2>App security scenario:</h2>
  
  <ul>
  <li>Spring MVC app running 3 instances on PaaS</li>
  <li>App is split in to 2 security domains. Managed w/ 2 DispatchServlets located at <code>/app</code> and <code>/kmlservice</code></li>
  <li>App must use https on all pages except for any paths within <code>/kmlservice</code> </li>
  <li>App must use custom login page to access all paths within <code>/app</code></li>
  <li>App must use persistent remember-me scheme with LDAP auth</li>
  </ul>
  
  <p>When we converted to https, we are getting infinite redirect loops when attempting to navigate to the <code>/app/login</code> page or any other page.  In fact even unprotected pages infinitely reroute to themselves.</p>
  
  <h2>Here is an example of the redirect logs we are seeing on attempting to navigate to <code>/app/login</code>:</h2>
  
  <pre><code>stdout.log: DEBUG: org.springframework.security.web.access.channel.ChannelProcessingFilter - Request: FilterInvocation: URL: /app/login; ConfigAttributes: [REQUIRES_SECURE_CHANNEL]
  stdout.log: DEBUG: org.springframework.security.web.access.channel.RetryWithHttpsEntryPoint - Redirecting to: https:/some_url.com/app/login
  stdout.log: DEBUG: org.springframework.security.web.DefaultRedirectStrategy - Redirecting to 'https:/some_url.com/app/login'
  stdout.log: DEBUG: org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/app/login'; against '/kmlservice/**'
  stdout.log: DEBUG: org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/app/login'; against '/resources/**'
  stdout.log: DEBUG: org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/app/login'; against '/app/**'
  stdout.log: DEBUG: org.springframework.security.web.FilterChainProxy - /app/login at position 1 of 12 in additional filter chain; firing Filter: 'ChannelProcessingFilter'
  stdout.log: DEBUG: org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/app/login'; against '/app/logout'
  stdout.log: DEBUG: org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/app/login'; against '/app/accessdenied'
  stdout.log: DEBUG: org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/app/login'; against '/app/useful_path'
  stdout.log: DEBUG: org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/app/login'; against '/app/help'
  stdout.log: DEBUG: org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/app/login'; against '/app/login'
  stdout.log: DEBUG: org.springframework.security.web.access.channel.ChannelProcessingFilter - Request: FilterInvocation: URL: /app/login; ConfigAttributes: [REQUIRES_SECURE_CHANNEL]
  stdout.log: DEBUG: org.springframework.security.web.access.channel.RetryWithHttpsEntryPoint - Redirecting to: https:/some_url.com/app/login
  stdout.log: DEBUG: org.springframework.security.web.DefaultRedirectStrategy - Redirecting to 'https:/some_url.com/app/login'
  </code></pre>
  
  <h2>Here's what the config looks like:</h2>
  
  <pre><code>&lt;http pattern="/kmlservice/**" use-expressions="true" auto-config="true"&gt;
      &lt;intercept-url pattern="/**" access="isAuthenticated()" /&gt;
      &lt;http-basic /&gt;
  &lt;/http&gt;
  
  &lt;http pattern="/resources/**" security="none" /&gt;
  
  &lt;http pattern="/app/**" use-expressions="true"&gt;
      &lt;form-login login-page="/app/login"
          authentication-failure-url="/app/accessdenied" default-target-url="/app" /&gt;
      &lt;intercept-url pattern="/app/logout" access="permitAll"
          requires-channel="https" /&gt;
      &lt;intercept-url pattern="/app/accessdenied" access="permitAll"
          requires-channel="https" /&gt;
      &lt;intercept-url pattern="/app/useful_path"
          access="hasRole('ROLE_HAS_ACCESS')" requires-channel="https" /&gt;
      &lt;intercept-url pattern="/app/help" access="permitAll"
          requires-channel="https" /&gt;
      &lt;intercept-url pattern="/app/login" access="IS_AUTHENTICATED_ANONYMOUSLY"
          requires-channel="https" /&gt;
      &lt;intercept-url pattern="/app/**" access="isAuthenticated()"
          requires-channel="https" /&gt;
      &lt;access-denied-handler error-page="/403" /&gt;
      &lt;logout logout-success-url="/app/logout" delete-cookies="JSESSIONID" /&gt;
      &lt;remember-me user-service-ref="userDetailsService"
          data-source-ref="dataSource" /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>I have tried to remove 
  <code>&lt;intercept-url pattern="/app/**" access="isAuthenticated()" requires-channel="https" /&gt;</code>
  which seemed to make no difference</p>
  
  <p>Is there any other useful config I could provide?<br>
  Thanks.</p>