Home » Java » Enterprise Java » Spring Security Part 2 – Password Encryption, Customize 404 and 403 error page

About Rajith Delantha

Rajith Delantha
Rajith is an software engineer, open source contributor and love to develop application based on open source projects.

Spring Security Part 2 – Password Encryption, Customize 404 and 403 error page

Here is the part 2 of spring security post. In this post I will show you how to encrypt password using MD5 and customize 403 and 404 status code error pages. If you haven’t read part 1 just click here. Because we continue the part 1 project here.

Download the Completed Project : http://www.mediafire.com/?tkm2vd9ro7oqhmu

First we will look at how to add password encryption to our project.

Edit the spring security file like below.

       <password-encoder hash='md5'/>  
       <jdbc-user-service data-source-ref='dataSource'  
                 users-by-username-query='select username,password, 'true' as enabled from USER_DETAILS where username=?'  
                 authorities-by-username-query='select USER_DETAILS.username , USER_AUTH.AUTHORITY as authorities from USER_DETAILS,USER_AUTH  
            where USER_DETAILS.username = ? AND USER_DETAILS.username=USER_AUTH.USERNAME '  

that’s it. We just added the md5 password encryption to our project.

To test this we need to edit out test-data.sql file like below.

 insert into USER_DETAILS values ('user','202cb962ac59075b964b07152d234b70'); -- password - 123  
 insert into USER_DETAILS values ('admin','21232f297a57a5a743894a0e4a801fc3'); -- password - admin  
 insert into USER_AUTH values ('user', 'ROLE_USER');  
 insert into USER_AUTH values ('admin', 'ROLE_ADMIN');  

Now we will look at how to customize the error pages based HTML status code. Otherwise the default error pages are very ugly. :D If you don’t have proper understanding about HTML status codes take a look at this.

In here we are handling 403(Permission denied) and 404(resource not found) status code. Because if you are dealing with spring security we definitely need to handle these two status code.(Not a must but a good practice)

There can be more that one way to do this. Changing spring security xml and add additional tag will do this but here we are not going to do that. Always keep it simple. So we are going to edit the web.xml and add error page tag to this task.

before that we need to create 404 and 403 customize error pages. Create two jsp pages and place it under webapp directory (Not inside WEB-INF directory).

after that change the web.xml and add below tags.


thats it. We just customize our error pages

These are some basic things that we can do with spring security. In near future I’ll come up with more interesting article about spring security with CAS integration , LDAP integration and many more. Stay Tuned :)

Reference: Spring Security Part 2 – Password Encryption, Customize 404 and 403 error page from our JCG partner Rajith Delantha at the Looping around with Rajith… blog.

(0 rating, 0 votes)
You need to be a registered member to rate this.
1 Comment Views Tweet it!
Do you want to know how to develop your skillset to become a Java Rockstar?
Subscribe to our newsletter to start Rocking right now!
To get you started we give you our best selling eBooks for FREE!
1. JPA Mini Book
2. JVM Troubleshooting Guide
3. JUnit Tutorial for Unit Testing
4. Java Annotations Tutorial
5. Java Interview Questions
6. Spring Interview Questions
7. Android UI Design
and many more ....
Email address:

Leave a Reply

1 Comment on "Spring Security Part 2 – Password Encryption, Customize 404 and 403 error page"

newest oldest most voted
Notify of
Joel Bondurant

md5 is not a very secure way to store passwords. bcrypt and scrypt are better options.