CSRF protection became default in the newer versions of Spring Security, and I just realized that it affects not just login/logout but also file uploading. In particular, when you upload files, you need to put the CSRF token in the query string, something like this:

<form:form action="apply.html?${_csrf.parameterName}=${_csrf.token}"

        modelAttribute="application" enctype="multipart/form-data">

... ...

</form:form>

My guess is that you have an email column instead of a username column, so you need to customize the other query too.

Hi Dr sun ,

If we want to use SecurityContextHolder.getContext().getAuthentication().getPrincipal()  to get login user , our User class must implement UserDetails interface ?

At first I used User user =(User)SecurityContextHolder.getContext() .getAuthentication().getPrincipal() to get a user ,

it gave me an error : can't cast from string to User . 

lishenyu wrote:

I have @Service(“userService”) annotation in UserDetailsServiceImpl class ,but when I run my project it gave me error of :

Error creating bean with name 'org.springframework.security.authentication.dao.DaoAuthenticationProvider#0': Cannot resolve reference to bean 'userService' while setting bean property 'userDetailsService'; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'userService' is defined

You probably need a <component-scan> to scan the package that includes userService.

lishenyu wrote:

now my component-scan is :base-package="csjobs.model" ,  you mean I can change it to base-package="csjobs" it will solve this problem right ?

And also this problem :

At first I used User user =(User)SecurityContextHolder.getContext() .getAuthentication().getPrincipal() to get a user ,

it gave me an error : can't cast from string to User . Why getPrincipal() returns string instead of UserDetails object ? Thanks !

Which package is your UserService in?

I'm having the same problem regarding the use of Principal as a User Object

I believe I was able to make it work by adding some missing beans references in applicationContext.xml following the sample code in csns2

However, I'm having an issue now with the actual login process. My usernames and passwords are returning invalid credentials.

Is the Spring controller for login using the Md5PasswordEncoder of the password i enter to compare with the plain text stored in the database, thus not matching returning an invalid login? I tried to store the password in the database as a MD5 Hash Encryption, but that didn't work either.

I am using Spring's default login page, not my own.

I'm not sure if something is not mapped correctly or the password is just plain wrong.

Thanks

<context:component-scan base-package="csjobs.model" />
<context:component-scan base-package="csjobs.security" />

<bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" /> 

<security:authentication-manager>
    <security:authentication-provider user-service-ref="myUserService">
         <security:password-encoder ref="passwordEncoder" /> 
    </security:authentication-provider>
</security:authentication-manager>

my UserDetailsServiceImpl class is in the cjobs.security package and my User class implements UserDetails

I also created a UserDao method, getUserByUsername

I got it working. My userDao method was checking the login to email instead of username.

i also removed the password encoder to check against plain text.

Thanks!