Spring Security: How do I reset SPRING_SECURITY_LAST_EXCEPTION.message?

Question

I am able to display the SPRING_SECURITY_LAST_EXCEPTION.message ("Bad Credentials") when a user tries to log in with incorrect credentials.

My login jsp currently uses the following code:

        <c:if test="${not empty SPRING_SECURITY_LAST_EXCEPTION.message}">
            <c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}" />
        </c:if>

My problem is that the "Bad Credentials" message is still there when the user navigates away from the login page and then comes back.

How can I reset SPRING_SECURITY_LAST_EXCEPTION.message when a user refreshes the login page?

Answer 1

The typical approach is to display error message only after failed login, where failed login is determined by request parameter. That is, you configure Spring Security as

<form-login ... authentication-failure-url = "/login?error=1" />

and show error message as

<c:if test="${not empty param['error']}"> 
    <c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}" /> 
</c:if> 

However, since SPRING_SECURITY_LAST_EXCEPTION is a session attribute, I guess you can reset it using the following approach:

<c:remove var = "SPRING_SECURITY_LAST_EXCEPTION" scope = "session" />