title: Spring Security (3.2.5) HTTP POST not forwarding to the original request after authentication
body: <p>I have a sample Spring MVC application, secured by Spring security (Spring version 4.0.1.RELEASE, Spring security 3.2.5.RELEASE.  When I send an HTTP GET request as an unauthenticated user, I am sent to the login page (as expected) where after I authenticate I am sent along to the page that was requested in the original GET.</p>
  
  <p>When I send an HTTP POST request as an unauthenticated user, I am sent to the login page (as expected), but then after successful authentication I am sent to the page as specified in my "default-target-url" instead of the page as requested in my original POST request.</p>
  
  <p>When I try this same HTTP POST as an authenticated user, it works just fine (as expected).  I have already tried setting always-use-default-target="false" as well as omitting that property altogether and the behavior is the same.</p>
  
  <p>Am I missing something?  Should Spring pass along the POST request after authentication or does that not happen by design for some reason?</p>
  
  <p>Here is my Spring security config:</p>
  
  <pre><code>    &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans" 
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
      &lt;http auto-config="true"&gt;
          &lt;intercept-url pattern="/admin/**" access="ROLE_USER" /&gt;
          &lt;form-login 
              login-page="/login.htm" 
              default-target-url="/hello.htm" 
              always-use-default-target="false"
              authentication-failure-url="/login.htm?error" 
              username-parameter="username"
              password-parameter="password" /&gt;
          &lt;logout logout-success-url="/login.htm?logout" /&gt;
          &lt;!-- enable csrf protection --&gt;
          &lt;csrf/&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
        &lt;authentication-provider&gt;
          &lt;user-service&gt;
          &lt;user name="admin" password="password" authorities="ROLE_USER" /&gt;
          &lt;user name="super" password="man" authorities="ROLE_SUPER_USER" /&gt;
          &lt;/user-service&gt;
        &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>Here is my jsp to initiate the test (a link to test the GET and a form to test the POST):</p>
  
  <pre><code>&lt;%@ include file="/WEB-INF/jsp/include.jsp" %&gt;
  &lt;%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %&gt;
  
  &lt;html&gt;
    &lt;head&gt;&lt;title&gt;TEST SECURITY&lt;/title&gt;&lt;/head&gt;
    &lt;body&gt;
          &lt;p&gt;&lt;a href="admin/security_landing.htm"&gt;GET&lt;/a&gt;&lt;/p&gt;
          &lt;form:form  method="POST" action="admin/security_landing.htm"&gt;&lt;input type="submit" value="POST"&gt;&lt;/form:form&gt;
  
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Here is the landing page which is a secured resource:</p>
  
  <pre><code>&lt;%@ include file="/WEB-INF/jsp/include.jsp" %&gt;
  &lt;%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %&gt;
  
  &lt;html&gt;
    &lt;head&gt;&lt;title&gt;TEST SECURITY LANDING PAGE&lt;/title&gt;&lt;/head&gt;
    &lt;body&gt;
          &lt;p&gt;YOU MADE IT!!!!&lt;/p&gt;
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>and here is my test controller:</p>
  
  <pre><code>package springapp.web;
  
  import org.springframework.stereotype.Controller;
  
  import org.springframework.web.bind.annotation.RequestMapping;
  import org.springframework.web.bind.annotation.RequestMethod;
  import org.springframework.web.bind.annotation.RequestParam;
  import org.springframework.web.servlet.ModelAndView;
  
  import org.apache.commons.logging.Log;
  import org.apache.commons.logging.LogFactory;
  
  
  @Controller
  public class TestController {
  
      /** Logger for this class and subclasses */
      protected final Log logger = LogFactory.getLog(getClass());
  
      @RequestMapping(value="test", method= RequestMethod.GET)
      public ModelAndView methodGet()
              {
  
          logger.info("Found it's way to the GET method");
  
          ModelAndView model = new ModelAndView();
  
          model.setViewName("security_test");
  
          return model;
  
      }
  
      @RequestMapping(value="/admin/security_landing", method=RequestMethod.POST)
      public ModelAndView sendToLandingPOST()
              {
  
          logger.info("Found it's way to the GET method");
  
          ModelAndView model = new ModelAndView();
  
          model.setViewName("/admin/security_landing");
  
          return model;
  
      }
  
      @RequestMapping(value="/admin/security_landing", method= RequestMethod.GET)
      public ModelAndView sendToLandingGET()
              {
  
          logger.info("Found it's way to the GET method");
  
          ModelAndView model = new ModelAndView();
  
          model.setViewName("/admin/security_landing");
  
          return model;
  
      }
  }
  </code></pre>
  
  <p>I can include more of the Spring configuration if it's relevant, but where the app is working fine with a GET but misbehaving (in my opinion) with a POST, I'm thinking it's isolated to the pieces I've shown here.</p>
  
  <p>It seems to me that Spring security should be able to intercept a POST and pass along the POST after authentication, just like a GET.</p>
  
  <p>Any hints or help would be appreciated.
  Thanks,
  Rob</p>