About Rajith Delantha

Rajith is an software engineer, open source contributor and love to develop application based on open source projects.

Spring Security Part 2 – Password Encryption, Customize 404 and 403 error page

Here is the part 2 of spring security post. In this post I will show you how to encrypt password using MD5 and customize 403 and 404 status code error pages. If you haven’t read part 1 just click here. Because we continue the part 1 project here.

Download the Completed Project : http://www.mediafire.com/?tkm2vd9ro7oqhmu

First we will look at how to add password encryption to our project.

Edit the spring security file like below.

 <authentication-manager>  
     <authentication-provider>  
       <password-encoder hash='md5'/>  
       <jdbc-user-service data-source-ref='dataSource'  
                 users-by-username-query='select username,password, 'true' as enabled from USER_DETAILS where username=?'  
                 authorities-by-username-query='select USER_DETAILS.username , USER_AUTH.AUTHORITY as authorities from USER_DETAILS,USER_AUTH  
            where USER_DETAILS.username = ? AND USER_DETAILS.username=USER_AUTH.USERNAME '  
           />  
     </authentication-provider>  
   </authentication-manager>  

that’s it. We just added the md5 password encryption to our project.

To test this we need to edit out test-data.sql file like below.

 insert into USER_DETAILS values ('user','202cb962ac59075b964b07152d234b70'); -- password - 123  
 insert into USER_DETAILS values ('admin','21232f297a57a5a743894a0e4a801fc3'); -- password - admin  
 insert into USER_AUTH values ('user', 'ROLE_USER');  
 insert into USER_AUTH values ('admin', 'ROLE_ADMIN');  

Now we will look at how to customize the error pages based HTML status code. Otherwise the default error pages are very ugly. :D If you don’t have proper understanding about HTML status codes take a look at this.

In here we are handling 403(Permission denied) and 404(resource not found) status code. Because if you are dealing with spring security we definitely need to handle these two status code.(Not a must but a good practice)

There can be more that one way to do this. Changing spring security xml and add additional tag will do this but here we are not going to do that. Always keep it simple. So we are going to edit the web.xml and add error page tag to this task.

before that we need to create 404 and 403 customize error pages. Create two jsp pages and place it under webapp directory (Not inside WEB-INF directory).

after that change the web.xml and add below tags.

 <error-page>  
     <error-code>404</error-code>  
     <location>/404.jsp</location>  
   </error-page>  
   <error-page>  
     <error-code>403</error-code>  
     <location>/403.jsp</location>  
   </error-page>  

thats it. We just customize our error pages

These are some basic things that we can do with spring security. In near future I’ll come up with more interesting article about spring security with CAS integration , LDAP integration and many more. Stay Tuned :)

Reference: Spring Security Part 2 – Password Encryption, Customize 404 and 403 error page from our JCG partner Rajith Delantha at the Looping around with Rajith… blog.

Do you want to know how to develop your skillset to become a Java Rockstar?

Subscribe to our newsletter to start Rocking right now!

To get you started we give you two of our best selling eBooks for FREE!

JPA Mini Book

Learn how to leverage the power of JPA in order to create robust and flexible Java applications. With this Mini Book, you will get introduced to JPA and smoothly transition to more advanced concepts.

JVM Troubleshooting Guide

The Java virtual machine is really the foundation of any Java EE platform. Learn how to master it with this advanced guide!

Given email address is already subscribed, thank you!
Oops. Something went wrong. Please try again later.
Please provide a valid email address.
Thank you, your sign-up request was successful! Please check your e-mail inbox.
Please complete the CAPTCHA.
Please fill in the required fields.

One Response to "Spring Security Part 2 – Password Encryption, Customize 404 and 403 error page"

  1. md5 is not a very secure way to store passwords. bcrypt and scrypt are better options.

Leave a Reply


6 + six =



Java Code Geeks and all content copyright © 2010-2014, Exelixis Media Ltd | Terms of Use | Privacy Policy | Contact
All trademarks and registered trademarks appearing on Java Code Geeks are the property of their respective owners.
Java is a trademark or registered trademark of Oracle Corporation in the United States and other countries.
Java Code Geeks is not connected to Oracle Corporation and is not sponsored by Oracle Corporation.
Do you want to know how to develop your skillset and become a ...
Java Rockstar?

Subscribe to our newsletter to start Rocking right now!

To get you started we give you two of our best selling eBooks for FREE!

Get ready to Rock!
You can download the complementary eBooks using the links below:
Close