title: Spring security login and logout
body: <p>I want to make a web application using spring security, but I feel something is wrong, or missing.</p>
  
  <p>Here are my codes:</p>
  
  <p>security.xml: </p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
         http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
         http://www.springframework.org/schema/security
         http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
  &lt;http use-expressions="true" disable-url-rewriting="true"&gt;
      &lt;intercept-url pattern="/index.htm" access="hasRole('ROLE_ADMIN')" /&gt;
      &lt;form-login login-processing-url="/login" login-page="/login.htm"
          username-parameter="userName" password-parameter="password"
          default-target-url="/index.htm" always-use-default-target="true"
          authentication-failure-url="/login.htm?auth=fail" /&gt;
      &lt;logout logout-url="/logout.htm" logout-success-url="/login?out=1"
          delete-cookies="JSESSIONID" invalidate-session="true" /&gt;
  &lt;/http&gt;
  
  &lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name="drs" password="123456" authorities="ROLE_ADMIN" /&gt;
              &lt;user name="dr" password="123456" authorities="ROLE_USER" /&gt;
          &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>controller:</p>
  
  <pre><code>@Controller
  public class SecurityController {
      @RequestMapping(value = "/logout.htm", method = RequestMethod.GET)
      public String logoutPage() {
          return "logoutPage";
      }
  
      @RequestMapping(value = "/login.htm", method = RequestMethod.GET)
      public String login() {
          return "loginPage";
      }
  }
  </code></pre>
  
  <p>login.jsp:</p>
  
  <pre><code>&lt;form:form action="${pageContext.request.contextPath}/login" method="POST"&gt;
      &lt;c:if test="${not empty param.err}"&gt;
          &lt;div&gt;
              &lt;c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}" /&gt;
          &lt;/div&gt;
      &lt;/c:if&gt;
      &lt;c:if test="${not empty param.out}"&gt;
          &lt;div&gt;You've logged out successfully.&lt;/div&gt;
      &lt;/c:if&gt;
      &lt;c:if test="${not empty param.time}"&gt;
          &lt;div&gt;You've been logged out due to inactivity.&lt;/div&gt;
      &lt;/c:if&gt;
  
      Username:&lt;br&gt;
      &lt;input type="text" name="userName" value="" /&gt;
      &lt;br&gt;
      &lt;br&gt; Password:&lt;br&gt;
      &lt;input type="password" name="password" value="" /&gt;
      &lt;input value="Login" name="submit" type="submit" /&gt;
  &lt;/form:form&gt;
  </code></pre>
  
  <p>logout.jsp: </p>
  
  <pre><code>&lt;a href="${pageContext.request.contextPath}/login.htm"&gt;Login&lt;/a&gt;
  </code></pre>
  
  <p>This work just fine, the only problem is when I hit the logout does nothing, I still have the permission which i had after the login.Normally it should be back to the login screen, asking the user to authenticate to access that page. What am I missing?</p>
  
  <p>And one more problem I couldn't figured out. When I change at the login form the:</p>
  
  <pre><code>&lt;form:form action="${pageContext.request.contextPath}/login" method="POST"&gt;
  </code></pre>
  
  <p>to:</p>
  
  <pre><code>&lt;form name='loginform' action="&lt;c:url value='j_spring_security_check' /&gt;" method='POST'&gt;
  </code></pre>
  
  <p>I get an error:</p>
  
  <blockquote>
    <p>HTTP Status 404 - /Dronomy_2.1/j_spring_security_check</p>
  </blockquote>
  
  <p>Can anyone help me?</p>