title: Spring boot authenticate for every request
body: <p>I'm working on spring-boot and use spring security for authentication. However, there is an issue with the login. When I request a URL which requires a login, it redirects me to the login page and then login is done successfully. But when I request the same URL or another URL while the user is logged in, it redirects me again to login. Seems the authentication doesn't recognise that user is logged in. Below is my code.
  Any help to fix the issue is appreciated.</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class LoginSecurityConfig extends WebSecurityConfigurerAdapter {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests()
              .antMatchers("/", "/find", "/forgotten", "/activation", "/reset-password", "/info/*",
                      "/css/**", "/js/**", "/img/**", "/login").permitAll()
              .antMatchers("/admin/*").access("hasRole('ADMIN')")
              .antMatchers("/user/**", "/project/**").access("hasRole('USER') or hasRole('ADMIN')")
              .and()
              .formLogin().successHandler(authenticationSuccessHandler())
              .loginPage("/login").failureUrl("/login?error")
              .and()
              .logout().logoutSuccessUrl("/").permitAll()
                  .and()
                  .exceptionHandling().accessDeniedPage("/403")
                  .and()
                  .csrf()
                  .disable();
          }
  }
  </code></pre>
  
  <p>And here is the loginController</p>
  
  <pre><code>@GetMapping("/login")
      public String showLogin(HttpServletRequest request, Model model, Principal principal, LoginForm loginForm) {
          String referer = request.getHeader("Referer");
  
          request.getSession().setAttribute(REDIRECT_URL_SESSION_ATTRIBUTE_NAME, referer);
  
          return principal == null ?  "login" : "redirect:/";
      }
  
      @PostMapping("/login-process")
      public String processLogin(@ModelAttribute("loginForm") final LoginForm loginForm,
                                  final BindingResult bindingResult, Principal principal, HttpServletRequest request) {
          User user = userService.findValidUser(loginForm.getEmail());
          try {
              if (user != null &amp;&amp; passwordEncoder.matches(hashWith256(loginForm.getPassword()), user.getPassword())) {
                  if(user.getVerified() == UserVerified.VERIFIED.getValue()){
                      request.getSession().setAttribute("user", user);
  
                          Object redirectURLObject = request.getSession().getAttribute(REDIRECT_URL_SESSION_ATTRIBUTE_NAME);
  
                          if(redirectURLObject != null){
                              URI uri =  new URI(redirectURLObject.toString());
  
                              return "redirect:" + uri.getPath();
                          }
  
                  }else {
                      bindingResult.rejectValue("email", "error", "Please verify your email via the email has been sent to you.");
                  }
              }else {
                  bindingResult.rejectValue("email", "error", "Invalid email or password.");
              }
          } catch (NoSuchAlgorithmException | URISyntaxException e) {
              LOG.error("An error occurred during login for user, " + user.getEmail(), e.getMessage());
          }
  
          if (bindingResult.hasErrors()) {
              return "login";
          }
  
          return "login";
      }
  </code></pre>
  
  <p>Here is the implementation of the success handler</p>
  
  <pre><code>public class CustomAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler implements
      AuthenticationSuccessHandler {
  
  public static final String REDIRECT_URL_SESSION_ATTRIBUTE_NAME = "REDIRECT_URL";
  
  public CustomAuthenticationSuccessHandler() {
      super();
      setUseReferer(true);
  }
  
  @Override
  public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                                      Authentication authentication) throws IOException, ServletException {
      Object redirectURLObject = request.getSession().getAttribute(REDIRECT_URL_SESSION_ATTRIBUTE_NAME);
  
      if(redirectURLObject != null)
          setDefaultTargetUrl(redirectURLObject.toString());
      else{
          setDefaultTargetUrl("/");
      }
  
      request.getSession().removeAttribute(REDIRECT_URL_SESSION_ATTRIBUTE_NAME);
  
      super.onAuthenticationSuccess(request, response, authentication);
  }
  
  }
  </code></pre>