formLogin

As explained in Spring Security in Action, Second Edition

formLogin is a Spring Security configuration method that enables authentication through an HTML form-based login flow.

formLogin enables authentication through an HTML form. In a SecurityFilterChain, it replaces httpBasic() for browser-oriented applications and redirects unauthenticated requests to a login page. section 6.3 section 6.3.2

Figure 6.13 Using form-based login. A user who has not yet been authenticated is sent to a form to log in with their credentials. After the application has verified their identity, they are directed to the application’s main page.

The flow sends an unauthenticated user to a login form, verifies credentials, and then directs the user to the application page. section 6.3.2

A minimal configuration provides several defaults:

• Calling http.formLogin(Customizer.withDefaults()) enables a login form and a logout page. section 6.3.2
• Without a registered UserDetailsService, the default user credentials can authenticate; the generated password appears in the startup console. section 6.3.2
• formLogin can be enabled alongside HTTP Basic when browser and command-line clients need different authentication methods. section 6.4

Small browser application

Configure formLogin, require authentication for every request, map /home to home.html through a controller, and redirect successful logins to /home.

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains defaults, redirects, handlers, and combined authentication, but defers larger scalability concerns to later OAuth 2 treatment.

Examples

Uses a home.html page, /home controller, default redirects, custom success and failure handlers, and curl HTTP Basic access.

What it assumes

Assumes basic Spring and Java knowledge while demonstrating SecurityFilterChain configuration and default authentication behavior.

What you can do after

Build it from scratch by configuring formLogin, protecting requests, serving an HTML page, and customizing authentication outcomes.

How it connects

Connects formLogin with HTTP Basic, server-side sessions, Spring MVC, SecurityContext, and OAuth 2.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

• form-based loginuses · Form-based login is an authentication technique in which a user submits credentials through an application-provided HTML form.
• SecurityFilterChainconfigures · SecurityFilterChain is a Spring Security component that applies ordered security filters and request-security rules to incoming web requests.
• login pageconfigures · A login page is an interface through which users submit authentication credentials to obtain access to an application or account.
• authenticationconfigures · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• basic authenticationalternative to · HTTP Basic authentication is an HTTP scheme that transmits a username and password in a Base64-encoded Authorization header, requiring external protection such as TLS for confidentiality.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.