diff --git a/src/docbkx/form-authentication.xml b/src/docbkx/form-authentication.xml index 3fdf4b2974..21123eb637 100644 --- a/src/docbkx/form-authentication.xml +++ b/src/docbkx/form-authentication.xml @@ -7,19 +7,19 @@ HTTP Form Authentication involves using the AuthenticationProcessingFilter to process a login - form. This is the most common way that application authenticate end + form. This is the most common way for an application to authenticate end users. Form-based authentication is entirely compatible with the DAO and JAAS authentication providers. -
Configuration - +
+ Configuration The login form simply contains j_username and j_password input fields, and posts to a URL that is monitored by the filter (by default - j_spring_security_check). You should add an - AuthenticationProcessingFilter to you application context: + /j_spring_security_check). You should add an + AuthenticationProcessingFilter to your application context: @@ -44,14 +44,13 @@ SecurityContextHolder. Once the SecurityContextHolder has been - updated, the browser will need to be redirected to the target URL. The - target URL is usually indicated by the HttpSession - attribute specified by + updated, the browser will need to be redirected to the target URL which + is usually indicated by the HttpSession attribute stored under AbstractProcessingFilter.SPRING_SECURITY_TARGET_URL_KEY. This attribute is automatically set by the ExceptionTranslationFilter when an AuthenticationException occurs, so that after login - is completed the user can return to what they were trying to access. + is completed the user can return to what they were originally trying to access. If for some reason the HttpSession does not indicate the target URL, the browser will be redirected to the defaultTargetUrl property.