So I have a Spring controller, using Spring Security that was blocked off with a simple It worked fine.
Now I have a requirement that -some- people don't need to be logged in unless they are after my grandmothers cookie recipe. So in my controller code I check to see what recipe they are after, and if it's cookies, I throw a BadCredentialsException();
Now I don't want to split out controller methods. These recipes will be in a DB and some (biscuits) will be available to everyone, others you will want a specific role. (Meats for example)
However, that looks like the exception is being picked up buy the general Exception interceptor and is being re-directed to the "something went wrong" page.
I want them to go to the login page, login, and then be redirected back to the recipe page.
<bean id="failureRedirectHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<property name="useForward" value="true"/>
</bean>
Again, this all worked with the intercept-url access="IS_AUTHENTICATED_FULLY" But why wont it work if I explicitly throw the BadCredentialsException?
I think the exception you want to throw is AccessDeniedException. With a standard configuration, that will redirect the user to the login page if currently not logged in. If logged in, an "access denied" page will be shown. You can customize this access denied page and for example include a link to login as a different user.
The BadCredentialsException is probably not intended to be thrown in controllers, but only internally in security filters, when user has actually has entered some wrong credentials.