config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java
private void checkLoginPageIsntProtected(FilterChainProxy fcp,
			List<Filter> filterStack) {
		ExceptionTranslationFilter etf = getFilter(ExceptionTranslationFilter.class,
				filterStack);

		if (etf == null
				|| !(etf.getAuthenticationEntryPoint() instanceof LoginUrlAuthenticationEntryPoint)) {
			return;
		}

		String loginPage = ((LoginUrlAuthenticationEntryPoint) etf
				.getAuthenticationEntryPoint()).getLoginFormUrl();
		logger.info("Checking whether login URL '" + loginPage
				+ "' is accessible with your configuration");
		FilterInvocation loginRequest = new FilterInvocation(loginPage, "POST");
		List<Filter> filters = null;

		try {
			filters = fcp.getFilters(loginPage);
		}
		catch (Exception e) {
			// May happen legitimately if a filter-chain request matcher requires more
			// request data than that provided
			// by the dummy request used when creating the filter invocation.
			logger.info("Failed to obtain filter chain information for the login page. Unable to complete check.");
		}

		if (filters == null || filters.isEmpty()) {
			logger.debug("Filter chain is empty for the login page");
			return;
		}

		if (getFilter(DefaultLoginPageGeneratingFilter.class, filters) != null) {
			logger.debug("Default generated login page is in use");
			return;
		}

		FilterSecurityInterceptor fsi = getFilter(FilterSecurityInterceptor.class,
				filters);
		FilterInvocationSecurityMetadataSource fids = fsi.getSecurityMetadataSource();

		Collection<ConfigAttribute> attributes = fids.getAttributes(loginRequest);

		if (attributes == null) {
			logger.debug("No access attributes defined for login page URL");
			if (fsi.isRejectPublicInvocations()) {
				logger.warn("FilterSecurityInterceptor is configured to reject public invocations."
						+ " Your login page may not be accessible.");
			}
			return;
		}

		AnonymousAuthenticationFilter anonPF = getFilter(
				AnonymousAuthenticationFilter.class, filters);
		if (anonPF == null) {
			logger.warn("The login page is being protected by the filter chain, but you don't appear to have"
					+ " anonymous authentication enabled. This is almost certainly an error.");
			return;
		}

		// Simulate an anonymous access with the supplied attributes.
		AnonymousAuthenticationToken token = new AnonymousAuthenticationToken("key",
				anonPF.getPrincipal(), anonPF.getAuthorities());
		try {
			fsi.getAccessDecisionManager().decide(token, loginRequest, attributes);
		}
		catch (AccessDeniedException e) {
			logger.warn("Anonymous access to the login page doesn't appear to be enabled. This is almost certainly "
					+ "an error. Please check your configuration allows unauthenticated access to the configured "
					+ "login page. (Simulated access was rejected: " + e + ")");
		}
		catch (Exception e) {
			// May happen legitimately if a filter-chain request matcher requires more
			// request data than that provided
			// by the dummy request used when creating the filter invocation. See SEC-1878
			logger.info(
					"Unable to check access to the login page to determine if anonymous access is allowed. This might be an error, but can happen under normal circumstances.",
					e);
		}
	}
private void checkLoginPageIsntProtected(FilterChainProxy fcp,
			List<Filter> filterStack) {
		ExceptionTranslationFilter etf = getFilter(ExceptionTranslationFilter.class,
				filterStack);

		if (etf == null
				|| !(etf.getAuthenticationEntryPoint() instanceof LoginUrlAuthenticationEntryPoint)) {
			return;
		}

		String loginPage = ((LoginUrlAuthenticationEntryPoint) etf
				.getAuthenticationEntryPoint()).getLoginFormUrl();
		logger.info("Checking whether login URL '" + loginPage
				+ "' is accessible with your configuration");
		FilterInvocation loginRequest = new FilterInvocation(loginPage, "POST");
		List<Filter> filters = null;

		try {
			filters = fcp.getFilters(loginPage);
		}
		catch (Exception e) {
			// May happen legitimately if a filter-chain request matcher requires more
			// request data than that provided
			// by the dummy request used when creating the filter invocation.
			logger.info("Failed to obtain filter chain information for the login page. Unable to complete check.");
		}

		if (filters == null || filters.isEmpty()) {
			logger.debug("Filter chain is empty for the login page");
			return;
		}

		if (getFilter(DefaultLoginPageGeneratingFilter.class, filters) != null) {
			logger.debug("Default generated login page is in use");
			return;
		}

		FilterSecurityInterceptor fsi = getFilter(FilterSecurityInterceptor.class,
				filters);
		FilterInvocationSecurityMetadataSource fids = fsi.getSecurityMetadataSource();

		Collection<ConfigAttribute> attributes = fids.getAttributes(loginRequest);

		if (attributes == null) {
			logger.debug("No access attributes defined for login page URL");
			if (fsi.isRejectPublicInvocations()) {
				logger.warn("FilterSecurityInterceptor is configured to reject public invocations."
						+ " Your login page may not be accessible.");
			}
			return;
		}

		AnonymousAuthenticationFilter anonPF = getFilter(
				AnonymousAuthenticationFilter.class, filters);
		if (anonPF == null) {
			logger.warn("The login page is being protected by the filter chain, but you don't appear to have"
					+ " anonymous authentication enabled. This is almost certainly an error.");
			return;
		}

		// Simulate an anonymous access with the supplied attributes.
		AnonymousAuthenticationToken token = new AnonymousAuthenticationToken("key",
				anonPF.getPrincipal(), anonPF.getAuthorities());
		try {
			fsi.getAccessDecisionManager().decide(token, loginRequest, attributes);
		}
		catch (AccessDeniedException e) {
			logger.warn("Anonymous access to the login page doesn't appear to be enabled. This is almost certainly "
					+ "an error. Please check your configuration allows unauthenticated access to the configured "
					+ "login page. (Simulated access was rejected: " + e + ")");
		}
		catch (Exception e) {
			// May happen legitimately if a filter-chain request matcher requires more
			// request data than that provided
			// by the dummy request used when creating the filter invocation. See SEC-1878
			logger.info(
					"Unable to check access to the login page to determine if anonymous access is allowed. This might be an error, but can happen under normal circumstances.",
					e);
		}
	}
private void checkLoginPageIsntProtected ( FilterChainProxy fcp , List < Filter > filterStack ) { ExceptionTranslationFilter etf = getFilter ( ExceptionTranslationFilter . class , filterStack ) ; if ( etf == null || ! ( etf . getAuthenticationEntryPoint ( ) instanceof LoginUrlAuthenticationEntryPoint ) ) { return ; } String loginPage = ( ( LoginUrlAuthenticationEntryPoint ) etf . getAuthenticationEntryPoint ( ) ) . getLoginFormUrl ( ) ; logger . info ( "Checking whether login URL '" + loginPage + "' is accessible with your configuration" ) ; FilterInvocation loginRequest = new FilterInvocation ( loginPage , "POST" ) ; List < Filter > filters = null ; try { filters = fcp . getFilters ( loginPage ) ; } catch ( Exception e ) { // May happen legitimately if a filter-chain request matcher requires more // request data than that provided // by the dummy request used when creating the filter invocation. logger . info ( "Failed to obtain filter chain information for the login page. Unable to complete check." ) ; } if ( filters == null || filters . isEmpty ( ) ) { logger . debug ( "Filter chain is empty for the login page" ) ; return ; } if ( getFilter ( DefaultLoginPageGeneratingFilter . class , filters ) != null ) { logger . debug ( "Default generated login page is in use" ) ; return ; } FilterSecurityInterceptor fsi = getFilter ( FilterSecurityInterceptor . class , filters ) ; FilterInvocationSecurityMetadataSource fids = fsi . getSecurityMetadataSource ( ) ; Collection < ConfigAttribute > attributes = fids . getAttributes ( loginRequest ) ; if ( attributes == null ) { logger . debug ( "No access attributes defined for login page URL" ) ; if ( fsi . isRejectPublicInvocations ( ) ) { logger . warn ( "FilterSecurityInterceptor is configured to reject public invocations." + " Your login page may not be accessible." ) ; } return ; } AnonymousAuthenticationFilter anonPF = getFilter ( AnonymousAuthenticationFilter . class , filters ) ; if ( anonPF == null ) { logger . warn ( "The login page is being protected by the filter chain, but you don't appear to have" + " anonymous authentication enabled. This is almost certainly an error." ) ; return ; } // Simulate an anonymous access with the supplied attributes. AnonymousAuthenticationToken token = new AnonymousAuthenticationToken ( "key" , anonPF . getPrincipal ( ) , anonPF . getAuthorities ( ) ) ; try { fsi . getAccessDecisionManager ( ) . decide ( token , loginRequest , attributes ) ; } catch ( AccessDeniedException e ) { logger . warn ( "Anonymous access to the login page doesn't appear to be enabled. This is almost certainly " + "an error. Please check your configuration allows unauthenticated access to the configured " + "login page. (Simulated access was rejected: " + e + ")" ) ; } catch ( Exception e ) { // May happen legitimately if a filter-chain request matcher requires more // request data than that provided // by the dummy request used when creating the filter invocation. See SEC-1878 logger . info ( "Unable to check access to the login page to determine if anonymous access is allowed. This might be an error, but can happen under normal circumstances." , e ) ; } }
/*
Checks for the common error of having a login page URL protected by the security
interceptor
/ * Checks for the common error of having a login page URL protected by the security interceptor