Skip to content

Commit c4b2232

Browse files
Tejas-Tejujzheaux
Tejas-Teju
authored and
jzheaux
committed
Return Invalid Credentials message on login error
Closes gh-16484 Signed-off-by: tejas-teju <[email protected]>
1 parent e42865b commit c4b2232

File tree

3 files changed

+6
-49
lines changed

3 files changed

+6
-49
lines changed

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,12 @@
2222
import org.springframework.beans.factory.annotation.Autowired;
2323
import org.springframework.context.annotation.Bean;
2424
import org.springframework.context.annotation.Configuration;
25-
import org.springframework.context.support.MessageSourceAccessor;
2625
import org.springframework.mock.web.MockHttpSession;
2726
import org.springframework.security.config.ObjectPostProcessor;
2827
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
2928
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
3029
import org.springframework.security.config.test.SpringTestContext;
3130
import org.springframework.security.config.test.SpringTestContextExtension;
32-
import org.springframework.security.core.SpringSecurityMessageSource;
3331
import org.springframework.security.core.userdetails.PasswordEncodedUser;
3432
import org.springframework.security.core.userdetails.UserDetailsService;
3533
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -77,8 +75,6 @@ public class DefaultLoginPageConfigurerTests {
7775
@Autowired
7876
MockMvc mvc;
7977

80-
MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
81-
8278
@Test
8379
public void getWhenFormLoginEnabledThenRedirectsToLoginPage() throws Exception {
8480
this.spring.register(DefaultLoginPageConfig.class).autowire();
@@ -148,8 +144,7 @@ public void loginPageWhenErrorThenDefaultLoginPageWithError() throws Exception {
148144
this.mvc.perform(get("/login?error").session((MockHttpSession) mvcResult.getRequest().getSession())
149145
.sessionAttr(csrfAttributeName, csrfToken))
150146
.andExpect((result) -> {
151-
String badCredentialsLocalizedMessage = this.messages
152-
.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials");
147+
String defaultErrorMessage = "Invalid credentials";
153148
CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName());
154149
assertThat(result.getResponse().getContentAsString()).isEqualTo("""
155150
<!DOCTYPE html>
@@ -184,7 +179,7 @@ public void loginPageWhenErrorThenDefaultLoginPageWithError() throws Exception {
184179
185180
</div>
186181
</body>
187-
</html>""".formatted(badCredentialsLocalizedMessage, token.getToken()));
182+
</html>""".formatted(defaultErrorMessage, token.getToken()));
188183
});
189184
// @formatter:on
190185
}

‎web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java‎

Lines changed: 1 addition & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,10 @@
2929
import jakarta.servlet.ServletResponse;
3030
import jakarta.servlet.http.HttpServletRequest;
3131
import jakarta.servlet.http.HttpServletResponse;
32-
import jakarta.servlet.http.HttpSession;
3332

34-
import org.springframework.security.core.AuthenticationException;
35-
import org.springframework.security.web.WebAttributes;
3633
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
3734
import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;
3835
import org.springframework.util.Assert;
39-
import org.springframework.util.StringUtils;
4036
import org.springframework.web.filter.GenericFilterBean;
4137

4238
/**
@@ -221,7 +217,7 @@ private void doFilter(HttpServletRequest request, HttpServletResponse response,
221217
}
222218

223219
private String generateLoginPageHtml(HttpServletRequest request, boolean loginError, boolean logoutSuccess) {
224-
String errorMsg = loginError ? getLoginErrorMessage(request) : "Invalid credentials";
220+
String errorMsg = "Invalid credentials";
225221
String contextPath = request.getContextPath();
226222

227223
return HtmlTemplates.fromTemplate(LOGIN_PAGE_TEMPLATE)
@@ -358,21 +354,6 @@ private static String renderSaml2Row(String contextPath, String url, String clie
358354
.render();
359355
}
360356

361-
private String getLoginErrorMessage(HttpServletRequest request) {
362-
HttpSession session = request.getSession(false);
363-
if (session == null) {
364-
return "Invalid credentials";
365-
}
366-
if (!(session
367-
.getAttribute(WebAttributes.AUTHENTICATION_EXCEPTION) instanceof AuthenticationException exception)) {
368-
return "Invalid credentials";
369-
}
370-
if (!StringUtils.hasText(exception.getMessage())) {
371-
return "Invalid credentials";
372-
}
373-
return exception.getMessage();
374-
}
375-
376357
private String renderHiddenInput(String name, String value) {
377358
return HtmlTemplates.fromTemplate(HIDDEN_HTML_INPUT_TEMPLATE)
378359
.withValue("name", name)

‎web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java‎

Lines changed: 3 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,14 @@
1818

1919
import java.io.IOException;
2020
import java.util.Collections;
21-
import java.util.Locale;
2221

2322
import jakarta.servlet.FilterChain;
2423
import jakarta.servlet.ServletException;
2524
import org.junit.jupiter.api.Test;
2625

27-
import org.springframework.context.support.MessageSourceAccessor;
2826
import org.springframework.mock.web.MockHttpServletRequest;
2927
import org.springframework.mock.web.MockHttpServletResponse;
3028
import org.springframework.security.authentication.BadCredentialsException;
31-
import org.springframework.security.core.SpringSecurityMessageSource;
3229
import org.springframework.security.web.WebAttributes;
3330
import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
3431

@@ -128,22 +125,6 @@ public void generatesForWithQueryNoMatch() throws Exception {
128125
assertThat(response.getContentAsString()).isEmpty();
129126
}
130127

131-
/* SEC-1111 */
132-
@Test
133-
public void handlesNonIso8859CharsInErrorMessage() throws Exception {
134-
DefaultLoginPageGeneratingFilter filter = new DefaultLoginPageGeneratingFilter(
135-
new UsernamePasswordAuthenticationFilter());
136-
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/login");
137-
MockHttpServletResponse response = new MockHttpServletResponse();
138-
request.setQueryString("error");
139-
MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
140-
String message = messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials",
141-
"Bad credentials", Locale.KOREA);
142-
request.getSession().setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION, new BadCredentialsException(message));
143-
filter.doFilter(request, response, this.chain);
144-
assertThat(response.getContentAsString()).contains(message);
145-
}
146-
147128
// gh-5394
148129
@Test
149130
public void generatesForOAuth2LoginAndEscapesClientName() throws Exception {
@@ -244,7 +225,7 @@ void generatesThenRenders() throws ServletException, IOException {
244225
<div class="content">
245226
<form class="login-form" method="post" action="null">
246227
<h2>Please sign in</h2>
247-
<div class="alert alert-danger" role="alert">Bad credentials</div>
228+
<div class="alert alert-danger" role="alert">Invalid credentials</div>
248229
<p>
249230
<label for="username" class="screenreader">Username</label>
250231
<input type="text" id="username" name="username" placeholder="Username" required autofocus>
@@ -259,12 +240,12 @@ void generatesThenRenders() throws ServletException, IOException {
259240
</form>
260241
261242
<h2>Login with OAuth 2.0</h2>
262-
<div class="alert alert-danger" role="alert">Bad credentials</div>
243+
<div class="alert alert-danger" role="alert">Invalid credentials</div>
263244
<table class="table table-striped">
264245
<tr><td><a href="/oauth2/authorization/google">Google &lt; &gt; &quot; &#39; &amp;</a></td></tr>
265246
</table>
266247
<h2>Login with SAML 2.0</h2>
267-
<div class="alert alert-danger" role="alert">Bad credentials</div>
248+
<div class="alert alert-danger" role="alert">Invalid credentials</div>
268249
<table class="table table-striped">
269250
<tr><td><a href="/saml/sso/google">Google &lt; &gt; &quot; &#39; &amp;</a></td></tr>
270251
</table>

0 commit comments

Comments
 (0)