SEC-2783: XML Configuration Defaults Should Match JavaConfig

* j_username -> username
* j_password -> password
* j_spring_security_check -> login
* j_spring_cas_security_check -> login/cas
* j_spring_cas_security_proxyreceptor -> login/cas/proxyreceptor
* j_spring_openid_security_login -> login/openid
* j_spring_security_switch_user -> login/impersonate
* j_spring_security_exit_user -> logout/impersonate
* login_error -> error
* use-expressions=true by default

config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

@@ -948,8 +948,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
      *                 .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
      *                 .and()
      *             .formLogin()
-     *                    .usernameParameter("j_username") // default is username
-     *                    .passwordParameter("j_password") // default is password
+     *                    .usernameParameter("username") // default is username
+     *                    .passwordParameter("password") // default is password
      *                    .loginPage("/authentication/login") // default is /login with an HTTP get
      *                    .failureUrl("/authentication/login?failed") // default is /login?error
      *                    .loginProcessingUrl("/authentication/login/process"); // default is /login with an HTTP post

config/src/main/java/org/springframework/security/config/authentication/AuthenticationManagerFactoryBean.java

@@ -6,8 +6,13 @@ import org.springframework.beans.factory.BeanFactoryAware;
 import org.springframework.beans.factory.FactoryBean;
 import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
 import org.springframework.security.config.BeanIds;
+import org.springframework.security.core.userdetails.UserDetailsService;
+
+import java.util.Arrays;
 
 /**
  * Factory bean for the namespace AuthenticationManager, which allows a more meaningful error message
@@ -28,6 +33,13 @@ public class AuthenticationManagerFactoryBean implements FactoryBean<Authenticat
              return (AuthenticationManager) bf.getBean(BeanIds.AUTHENTICATION_MANAGER);
         } catch (NoSuchBeanDefinitionException e) {
             if (BeanIds.AUTHENTICATION_MANAGER.equals(e.getBeanName())) {
+                try {
+                    UserDetailsService uds = bf.getBean(UserDetailsService.class);
+                    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
+                    provider.setUserDetailsService(uds);
+                    provider.afterPropertiesSet();
+                    return new ProviderManager(Arrays.<AuthenticationProvider>asList(provider));
+                } catch(NoSuchBeanDefinitionException noUds) {}
                 throw new NoSuchBeanDefinitionException(BeanIds.AUTHENTICATION_MANAGER, MISSING_BEAN_ERROR_MESSAGE);
             }
             throw e;

config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java

@@ -130,12 +130,12 @@ final class AuthenticationConfigBuilder {
     private String loginProcessingUrl;
     private String openidLoginProcessingUrl;
 
-    public AuthenticationConfigBuilder(Element element, ParserContext pc, SessionCreationPolicy sessionPolicy,
+    public AuthenticationConfigBuilder(Element element, boolean forceAutoConfig, ParserContext pc, SessionCreationPolicy sessionPolicy,
             BeanReference requestCache, BeanReference authenticationManager, BeanReference sessionStrategy, BeanReference portMapper, BeanReference portResolver, BeanMetadataElement csrfLogoutHandler) {
         this.httpElt = element;
         this.pc = pc;
         this.requestCache = requestCache;
-        autoConfig = "true".equals(element.getAttribute(ATT_AUTO_CONFIG));
+        autoConfig = forceAutoConfig | "true".equals(element.getAttribute(ATT_AUTO_CONFIG));
         this.allowSessionCreation = sessionPolicy != SessionCreationPolicy.NEVER
                 && sessionPolicy != SessionCreationPolicy.STATELESS;
         this.portMapper = portMapper;
@@ -193,7 +193,7 @@ final class AuthenticationConfigBuilder {
         RootBeanDefinition formFilter = null;
 
         if (formLoginElt != null || autoConfig) {
-            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_security_check",
+            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/login", "POST",
                     AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache, sessionStrategy, allowSessionCreation, portMapper, portResolver);
 
             parser.parse(formLoginElt, pc);
@@ -218,7 +218,7 @@ final class AuthenticationConfigBuilder {
         RootBeanDefinition openIDFilter = null;
 
         if (openIDLoginElt != null) {
-            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_openid_security_check",
+            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/login/openid", null,
                     OPEN_ID_AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache, sessionStrategy, allowSessionCreation, portMapper, portResolver);
 
             parser.parse(openIDLoginElt, pc);
@@ -492,7 +492,11 @@ final class AuthenticationConfigBuilder {
     void createLogoutFilter() {
         Element logoutElt = DomUtils.getChildElementByTagName(httpElt, Elements.LOGOUT);
         if (logoutElt != null || autoConfig) {
-            LogoutBeanDefinitionParser logoutParser = new LogoutBeanDefinitionParser(rememberMeServicesId, csrfLogoutHandler);
+            String formLoginPage = getLoginFormUrl(formEntryPoint);
+            if(formLoginPage == null) {
+                formLoginPage = DefaultLoginPageGeneratingFilter.DEFAULT_LOGIN_PAGE_URL;
+            }
+            LogoutBeanDefinitionParser logoutParser = new LogoutBeanDefinitionParser(formLoginPage,rememberMeServicesId, csrfLogoutHandler);
             logoutFilter = logoutParser.parse(logoutElt, pc);
             logoutHandlers = logoutParser.getLogoutHandlers();
         }

config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java

@@ -48,7 +48,7 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
             }
         }
 
-        BeanDefinition mds = createSecurityMetadataSource(interceptUrls, element, parserContext);
+        BeanDefinition mds = createSecurityMetadataSource(interceptUrls, false, element, parserContext);
 
         String id = element.getAttribute(AbstractBeanDefinitionParser.ID_ATTRIBUTE);
 
@@ -60,16 +60,16 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
         return mds;
     }
 
-    static RootBeanDefinition createSecurityMetadataSource(List<Element> interceptUrls, Element elt, ParserContext pc) {
-        MatcherType matcherType = MatcherType.fromElement(elt);
-        boolean useExpressions = isUseExpressions(elt);
+    static RootBeanDefinition createSecurityMetadataSource(List<Element> interceptUrls, boolean addAllAuth, Element httpElt, ParserContext pc) {
+        MatcherType matcherType = MatcherType.fromElement(httpElt);
+        boolean useExpressions = isUseExpressions(httpElt);
 
         ManagedMap<BeanDefinition, BeanDefinition> requestToAttributesMap = parseInterceptUrlsForFilterInvocationRequestMap(
-                matcherType, interceptUrls, useExpressions, pc);
+                matcherType, interceptUrls, useExpressions, addAllAuth, pc);
         BeanDefinitionBuilder fidsBuilder;
 
         if (useExpressions) {
-            Element expressionHandlerElt = DomUtils.getChildElementByTagName(elt, Elements.EXPRESSION_HANDLER);
+            Element expressionHandlerElt = DomUtils.getChildElementByTagName(httpElt, Elements.EXPRESSION_HANDLER);
             String expressionHandlerRef = expressionHandlerElt == null ? null : expressionHandlerElt.getAttribute("ref");
 
             if (StringUtils.hasText(expressionHandlerRef)) {
@@ -86,7 +86,7 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
             fidsBuilder.addConstructorArgValue(requestToAttributesMap);
         }
 
-        fidsBuilder.getRawBeanDefinition().setSource(pc.extractSource(elt));
+        fidsBuilder.getRawBeanDefinition().setSource(pc.extractSource(httpElt));
 
         return (RootBeanDefinition) fidsBuilder.getBeanDefinition();
     }
@@ -100,12 +100,13 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
     }
 
     static boolean isUseExpressions(Element elt) {
-        return "true".equals(elt.getAttribute(ATT_USE_EXPRESSIONS));
+        String useExpressions = elt.getAttribute(ATT_USE_EXPRESSIONS);
+        return !StringUtils.hasText(useExpressions) || "true".equals(useExpressions);
     }
 
     private static ManagedMap<BeanDefinition, BeanDefinition>
         parseInterceptUrlsForFilterInvocationRequestMap(MatcherType matcherType,
-                List<Element> urlElts, boolean useExpressions, ParserContext parserContext) {
+                List<Element> urlElts, boolean useExpressions, boolean addAuthenticatedAll, ParserContext parserContext) {
 
         ManagedMap<BeanDefinition, BeanDefinition> filterInvocationDefinitionMap = new ManagedMap<BeanDefinition, BeanDefinition>();
 
@@ -147,6 +148,15 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
             filterInvocationDefinitionMap.put(matcher, attributeBuilder.getBeanDefinition());
         }
 
+        if(addAuthenticatedAll && filterInvocationDefinitionMap.isEmpty()) {
+
+            BeanDefinition matcher = matcherType.createMatcher("/**", null);
+            BeanDefinitionBuilder attributeBuilder = BeanDefinitionBuilder.rootBeanDefinition(SecurityConfig.class);
+            attributeBuilder.addConstructorArgValue(new String[] { "authenticated" });
+            attributeBuilder.setFactoryMethod("createList");
+            filterInvocationDefinitionMap.put(matcher, attributeBuilder.getBeanDefinition());
+        }
+
         return filterInvocationDefinitionMap;
     }
 

config/src/main/java/org/springframework/security/config/http/FormLoginBeanDefinitionParser.java

@@ -66,11 +66,13 @@ public class FormLoginBeanDefinitionParser {
     private RootBeanDefinition filterBean;
     private RootBeanDefinition entryPointBean;
     private String loginPage;
+    private String loginMethod;
     private String loginProcessingUrl;
 
-    FormLoginBeanDefinitionParser(String defaultLoginProcessingUrl, String filterClassName,
+    FormLoginBeanDefinitionParser(String defaultLoginProcessingUrl, String loginMethod, String filterClassName,
             BeanReference requestCache, BeanReference sessionStrategy, boolean allowSessionCreation, BeanReference portMapper, BeanReference portResolver) {
         this.defaultLoginProcessingUrl = defaultLoginProcessingUrl;
+        this.loginMethod = loginMethod;
         this.filterClassName = filterClassName;
         this.requestCache = requestCache;
         this.sessionStrategy = sessionStrategy;
@@ -153,6 +155,9 @@ public class FormLoginBeanDefinitionParser {
 
         BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.util.matcher.AntPathRequestMatcher");
         matcherBuilder.addConstructorArgValue(loginUrl);
+        if(loginMethod != null) {
+            matcherBuilder.addConstructorArgValue("POST");
+        }
 
         filterBuilder.addPropertyValue("requiresAuthenticationRequestMatcher", matcherBuilder.getBeanDefinition());
 

config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java

@@ -133,10 +133,12 @@ class HttpConfigurationBuilder {
     private CsrfBeanDefinitionParser csrfParser;
 
     private BeanDefinition invalidSession;
+    private boolean addAllAuth;
 
-    public HttpConfigurationBuilder(Element element, ParserContext pc,
+    public HttpConfigurationBuilder(Element element, boolean addAllAuth, ParserContext pc,
             BeanReference portMapper, BeanReference portResolver, BeanReference authenticationManager) {
         this.httpElt = element;
+        this.addAllAuth = addAllAuth;
         this.pc = pc;
         this.portMapper = portMapper;
         this.portResolver = portResolver;
@@ -583,7 +585,7 @@ class HttpConfigurationBuilder {
 
     private void createFilterSecurityInterceptor(BeanReference authManager) {
         boolean useExpressions = FilterInvocationSecurityMetadataSourceParser.isUseExpressions(httpElt);
-        RootBeanDefinition securityMds = FilterInvocationSecurityMetadataSourceParser.createSecurityMetadataSource(interceptUrls, httpElt, pc);
+        RootBeanDefinition securityMds = FilterInvocationSecurityMetadataSourceParser.createSecurityMetadataSource(interceptUrls, addAllAuth, httpElt, pc);
 
         RootBeanDefinition accessDecisionMgr;
         ManagedList<BeanDefinition> voters =  new ManagedList<BeanDefinition>(2);

config/src/main/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParser.java

@@ -132,10 +132,11 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
         ManagedList<BeanReference> authenticationProviders = new ManagedList<BeanReference>();
         BeanReference authenticationManager = createAuthenticationManager(element, pc, authenticationProviders);
 
-        HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder(element, pc,
+        boolean forceAutoConfig = isDefaultHttpConfig(element);
+        HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder(element, forceAutoConfig, pc,
                 portMapper, portResolver, authenticationManager);
 
-        AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder(element, pc,
+        AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder(element, forceAutoConfig, pc,
                 httpBldr.getSessionCreationPolicy(), httpBldr.getRequestCache(), authenticationManager,
                 httpBldr.getSessionStrategy(), portMapper, portResolver, httpBldr.getCsrfLogoutHandler());
 
@@ -164,6 +165,10 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
         return createSecurityFilterChainBean(element, pc, filterChain);
     }
 
+    private static boolean isDefaultHttpConfig(Element httpElt) {
+        return httpElt.getChildNodes().getLength() == 0 && httpElt.getAttributes().getLength() == 0;
+    }
+
     private BeanReference createSecurityFilterChainBean(Element element, ParserContext pc, List<?> filterChain) {
         BeanMetadataElement filterChainMatcher;
 

config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java

@@ -35,23 +35,24 @@ import org.w3c.dom.Element;
  */
 class LogoutBeanDefinitionParser implements BeanDefinitionParser {
     static final String ATT_LOGOUT_SUCCESS_URL = "logout-success-url";
-    static final String DEF_LOGOUT_SUCCESS_URL = "/";
 
     static final String ATT_INVALIDATE_SESSION = "invalidate-session";
 
     static final String ATT_LOGOUT_URL = "logout-url";
-    static final String DEF_LOGOUT_URL = "/j_spring_security_logout";
+    static final String DEF_LOGOUT_URL = "/logout";
     static final String ATT_LOGOUT_HANDLER = "success-handler-ref";
     static final String ATT_DELETE_COOKIES = "delete-cookies";
 
     final String rememberMeServices;
+    private final String defaultLogoutUrl;
     private ManagedList<BeanMetadataElement> logoutHandlers = new ManagedList<BeanMetadataElement>();
     private boolean csrfEnabled;
 
-    public LogoutBeanDefinitionParser(String rememberMeServices, BeanMetadataElement csrfLogoutHandler) {
+    public LogoutBeanDefinitionParser(String loginPageUrl, String rememberMeServices, BeanMetadataElement csrfLogoutHandler) {
+        this.defaultLogoutUrl = loginPageUrl + "?logout";
         this.rememberMeServices = rememberMeServices;
         this.csrfEnabled = csrfLogoutHandler != null;
-        if(this.csrfEnabled) {
+        if (this.csrfEnabled) {
             logoutHandlers.add(csrfLogoutHandler);
         }
     }
@@ -93,7 +94,7 @@ class LogoutBeanDefinitionParser implements BeanDefinitionParser {
         } else {
             // Use the logout URL if no handler set
             if (!StringUtils.hasText(logoutSuccessUrl)) {
-                logoutSuccessUrl = DEF_LOGOUT_SUCCESS_URL;
+                logoutSuccessUrl = defaultLogoutUrl;
             }
             builder.addConstructorArgValue(logoutSuccessUrl);
         }

config/src/main/resources/org/springframework/security/config/spring-security-2.0.1.xsd

@@ -844,7 +844,7 @@
       <xs:annotation>
         <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
           initialize a filter that responds to this particular URL. Defaults to
-          /j_spring_security_logout if unspecified.</xs:documentation>
+          /logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:string">
@@ -864,7 +864,7 @@
     <xs:attribute name="login-processing-url" type="xs:string">
       <xs:annotation>
         <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-          /j_spring_security_check.</xs:documentation>
+          /login.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:string">

config/src/main/resources/org/springframework/security/config/spring-security-2.0.2.xsd

@@ -863,7 +863,7 @@
       <xs:annotation>
         <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
           initialize a filter that responds to this particular URL. Defaults to
-          /j_spring_security_logout if unspecified.</xs:documentation>
+          /logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:string">
@@ -883,7 +883,7 @@
     <xs:attribute name="login-processing-url" type="xs:string">
       <xs:annotation>
         <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-          /j_spring_security_check.</xs:documentation>
+          /login.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:string">

config/src/main/resources/org/springframework/security/config/spring-security-2.0.4.xsd

@@ -893,7 +893,7 @@
       <xs:annotation>
         <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
           initialize a filter that responds to this particular URL. Defaults to
-          /j_spring_security_logout if unspecified.</xs:documentation>
+          /logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:string">
@@ -913,7 +913,7 @@
     <xs:attribute name="login-processing-url" type="xs:string">
       <xs:annotation>
         <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-          /j_spring_security_check.</xs:documentation>
+          /login.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:string">

config/src/main/resources/org/springframework/security/config/spring-security-2.0.xsd

@@ -772,7 +772,7 @@
       <xs:annotation>
         <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
           initialize a filter that responds to this particular URL. Defaults to
-          /j_spring_security_logout if unspecified.</xs:documentation>
+          /logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:string">
@@ -792,7 +792,7 @@
     <xs:attribute name="login-processing-url" type="xs:string">
       <xs:annotation>
         <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-          /j_spring_security_check.</xs:documentation>
+          /login.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:string">

config/src/main/resources/org/springframework/security/config/spring-security-3.0.3.xsd

@@ -799,7 +799,7 @@
   <xs:attributeGroup name="logout.attlist">
     <xs:attribute name="logout-url" type="xs:token">
       <xs:annotation>
-        <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.</xs:documentation>
+        <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:token">
@@ -827,7 +827,7 @@
   <xs:attributeGroup name="form-login.attlist">
     <xs:attribute name="login-processing-url" type="xs:token">
       <xs:annotation>
-        <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.</xs:documentation>
+        <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /login.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:token">

config/src/main/resources/org/springframework/security/config/spring-security-3.0.xsd

@@ -787,7 +787,7 @@
   <xs:attributeGroup name="logout.attlist">
     <xs:attribute name="logout-url" type="xs:token">
       <xs:annotation>
-        <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.</xs:documentation>
+        <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:token">
@@ -815,7 +815,7 @@
   <xs:attributeGroup name="form-login.attlist">
     <xs:attribute name="login-processing-url" type="xs:token">
       <xs:annotation>
-        <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.</xs:documentation>
+        <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /login.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:token">

config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc

@@ -370,7 +370,7 @@ logout =
     ## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
     element logout {logout.attlist, empty}
 logout.attlist &=
-    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
     attribute logout-url {xsd:token}?
 logout.attlist &=
     ## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
@@ -393,13 +393,13 @@ form-login =
     ## Sets up a form login configuration for authentication with a username and password
     element form-login {form-login.attlist, empty}
 form-login.attlist &=
-    ## The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
+    ## The URL that the login form is posted to. If unspecified, it defaults to /login.
     attribute login-processing-url {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the username. Defaults to 'j_username'.
+    ## The name of the request parameter which contains the username. Defaults to 'username'.
     attribute username-parameter {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the password. Defaults to 'j_password'.
+    ## The name of the request parameter which contains the password. Defaults to 'password'.
     attribute password-parameter {xsd:token}?
 form-login.attlist &=
     ## The URL that will be redirected to after successful authentication, if the user's previous action could not be resumed. This generally happens if the user visits a login page without having first requested a secured operation that triggers authentication. If unspecified, defaults to the root of the application.

config/src/main/resources/org/springframework/security/config/spring-security-3.1.xsd

@@ -1278,7 +1278,7 @@
       <xs:attribute name="logout-url" type="xs:token">
          <xs:annotation>
             <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that
-                responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+                responds to this particular URL. Defaults to /logout if unspecified.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
@@ -1325,19 +1325,19 @@
       <xs:attribute name="login-processing-url" type="xs:token">
          <xs:annotation>
             <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-                /j_spring_security_check.
+                /login.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="username-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'j_username'.
+            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'username'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="password-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'j_password'.
+            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'password'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>

config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc

@@ -370,7 +370,7 @@ logout =
     ## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
     element logout {logout.attlist, empty}
 logout.attlist &=
-    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
     attribute logout-url {xsd:token}?
 logout.attlist &=
     ## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
@@ -393,13 +393,13 @@ form-login =
     ## Sets up a form login configuration for authentication with a username and password
     element form-login {form-login.attlist, empty}
 form-login.attlist &=
-    ## The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
+    ## The URL that the login form is posted to. If unspecified, it defaults to /login.
     attribute login-processing-url {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the username. Defaults to 'j_username'.
+    ## The name of the request parameter which contains the username. Defaults to 'username'.
     attribute username-parameter {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the password. Defaults to 'j_password'.
+    ## The name of the request parameter which contains the password. Defaults to 'password'.
     attribute password-parameter {xsd:token}?
 form-login.attlist &=
     ## The URL that will be redirected to after successful authentication, if the user's previous action could not be resumed. This generally happens if the user visits a login page without having first requested a secured operation that triggers authentication. If unspecified, defaults to the root of the application.

config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd

@@ -1280,7 +1280,7 @@
       <xs:attribute name="logout-url" type="xs:token">
          <xs:annotation>
             <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that
-                responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+                responds to this particular URL. Defaults to /logout if unspecified.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
@@ -1327,19 +1327,19 @@
       <xs:attribute name="login-processing-url" type="xs:token">
          <xs:annotation>
             <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-                /j_spring_security_check.
+                /login.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="username-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'j_username'.
+            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'username'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="password-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'j_password'.
+            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'password'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>

config/src/main/resources/org/springframework/security/config/spring-security-4.0.rnc

@@ -73,7 +73,7 @@ role-prefix =
     attribute role-prefix {xsd:token}
 
 use-expressions =
-    ## Enables the use of expressions in the 'access' attributes in <intercept-url> elements rather than the traditional list of configuration attributes. Defaults to 'false'. If enabled, each attribute should contain a single boolean expression. If the expression evaluates to 'true', access will be granted.
+    ## Enables the use of expressions in the 'access' attributes in <intercept-url> elements rather than the traditional list of configuration attributes. Defaults to 'true'. If enabled, each attribute should contain a single boolean expression. If the expression evaluates to 'true', access will be granted.
     attribute use-expressions {xsd:boolean}
 
 ldap-server =
@@ -380,7 +380,7 @@ logout =
     ## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
     element logout {logout.attlist, empty}
 logout.attlist &=
-    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
     attribute logout-url {xsd:token}?
 logout.attlist &=
     ## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
@@ -403,13 +403,13 @@ form-login =
     ## Sets up a form login configuration for authentication with a username and password
     element form-login {form-login.attlist, empty}
 form-login.attlist &=
-    ## The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
+    ## The URL that the login form is posted to. If unspecified, it defaults to /login.
     attribute login-processing-url {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the username. Defaults to 'j_username'.
+    ## The name of the request parameter which contains the username. Defaults to 'username'.
     attribute username-parameter {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the password. Defaults to 'j_password'.
+    ## The name of the request parameter which contains the password. Defaults to 'password'.
     attribute password-parameter {xsd:token}?
 form-login.attlist &=
     ## The URL that will be redirected to after successful authentication, if the user's previous action could not be resumed. This generally happens if the user visits a login page without having first requested a secured operation that triggers authentication. If unspecified, defaults to the root of the application.
@@ -418,10 +418,10 @@ form-login.attlist &=
     ## Whether the user should always be redirected to the default-target-url after login.
     attribute always-use-default-target {xsd:boolean}?
 form-login.attlist &=
-    ## The URL for the login page. If no login URL is specified, Spring Security will automatically create a login URL at /spring_security_login and a corresponding filter to render that login URL when requested.
+    ## The URL for the login page. If no login URL is specified, Spring Security will automatically create a login URL at GET /login and a corresponding filter to render that login URL when requested.
     attribute login-page {xsd:token}?
 form-login.attlist &=
-    ## The URL for the login failure page. If no login failure URL is specified, Spring Security will automatically create a failure login URL at /spring_security_login?login_error and a corresponding filter to render that login failure URL when requested.
+    ## The URL for the login failure page. If no login failure URL is specified, Spring Security will automatically create a failure login URL at /login?error and a corresponding filter to render that login failure URL when requested.
     attribute authentication-failure-url {xsd:token}?
 form-login.attlist &=
     ## Reference to an AuthenticationSuccessHandler bean which should be used to handle a successful authentication request. Should not be used in combination with default-target-url (or always-use-default-target-url) as the implementation should always deal with navigation to the subsequent destination

config/src/main/resources/org/springframework/security/config/spring-security-4.0.xsd

@@ -1307,7 +1307,7 @@
       <xs:attribute name="logout-url" type="xs:token">
          <xs:annotation>
             <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that
-                responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+                responds to this particular URL. Defaults to /logout if unspecified.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
@@ -1354,19 +1354,19 @@
       <xs:attribute name="login-processing-url" type="xs:token">
          <xs:annotation>
             <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-                /j_spring_security_check.
+                /login.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="username-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'j_username'.
+            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'username'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="password-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'j_password'.
+            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'password'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
@@ -1388,7 +1388,7 @@
       <xs:attribute name="login-page" type="xs:token">
          <xs:annotation>
             <xs:documentation>The URL for the login page. If no login URL is specified, Spring Security will
-                automatically create a login URL at /spring_security_login and a corresponding filter to
+                automatically create a login URL at GET /login and a corresponding filter to
                 render that login URL when requested.
                 </xs:documentation>
          </xs:annotation>
@@ -1396,7 +1396,7 @@
       <xs:attribute name="authentication-failure-url" type="xs:token">
          <xs:annotation>
             <xs:documentation>The URL for the login failure page. If no login failure URL is specified, Spring Security
-                will automatically create a failure login URL at /spring_security_login?login_error and a
+                will automatically create a failure login URL at /login?error and a
                 corresponding filter to render that login failure URL when requested.
                 </xs:documentation>
          </xs:annotation>

config/src/test/groovy/org/springframework/security/config/annotation/web/SampleWebSecurityConfigurerAdapterTests.groovy

@@ -63,7 +63,7 @@ public class SampleWebSecurityConfigurerAdapterTests extends BaseSpringSpec {
 
     /**
      * <code>
-     *   <http use-expressions="true">
+     *   <http>
      *     <intercept-url pattern="/resources/**" access="permitAll"/>
      *     <intercept-url pattern="/**" access="authenticated"/>
      *     <logout
@@ -126,7 +126,7 @@ public class SampleWebSecurityConfigurerAdapterTests extends BaseSpringSpec {
     /**
      * <code>
      *   <http security="none" pattern="/resources/**"/>
-     *   <http use-expressions="true">
+     *   <http>
      *     <intercept-url pattern="/logout" access="permitAll"/>
      *     <intercept-url pattern="/login" access="permitAll"/>
      *     <intercept-url pattern="/signup" access="permitAll"/>
@@ -239,12 +239,12 @@ public class SampleWebSecurityConfigurerAdapterTests extends BaseSpringSpec {
     /**
      * <code>
      *   <http security="none" pattern="/resources/**"/>
-     *   <http use-expressions="true" pattern="/api/**">
+     *   <http pattern="/api/**">
      *     <intercept-url pattern="/api/admin/**" access="hasRole('ROLE_ADMIN')"/>
      *     <intercept-url pattern="/api/**" access="hasRole('ROLE_USER')"/>
      *     <http-basic />
      *   </http>
-     *   <http use-expressions="true">
+     *   <http>
      *     <intercept-url pattern="/logout" access="permitAll"/>
      *     <intercept-url pattern="/login" access="permitAll"/>
      *     <intercept-url pattern="/signup" access="permitAll"/>

config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.groovy

@@ -105,8 +105,8 @@ public class NamespaceHttpFormLoginTests extends BaseSpringSpec {
             super.setup()
             request.servletPath = "/authentication/login/process"
             request.method = "POST"
-            request.parameters.j_username = ["user"] as String[]
-            request.parameters.j_password = ["password"] as String[]
+            request.parameters.username = ["user"] as String[]
+            request.parameters.password = ["password"] as String[]
             springSecurityFilterChain.doFilter(request,response,chain)
         then: "sent to default succes page"
             response.getRedirectedUrl() == "/default"
@@ -121,8 +121,8 @@ public class NamespaceHttpFormLoginTests extends BaseSpringSpec {
                     .anyRequest().hasRole("USER")
                     .and()
                 .formLogin()
-                    .usernameParameter("j_username") // form-login@username-parameter
-                    .passwordParameter("j_password") // form-login@password-parameter
+                    .usernameParameter("username") // form-login@username-parameter
+                    .passwordParameter("password") // form-login@password-parameter
                     .loginPage("/authentication/login") // form-login@login-page
                     .failureUrl("/authentication/login?failed") // form-login@authentication-failure-url
                     .loginProcessingUrl("/authentication/login/process") // form-login@login-processing-url

config/src/test/groovy/org/springframework/security/config/http/AbstractHttpConfigTests.groovy

@@ -20,6 +20,8 @@ import org.springframework.security.config.AbstractXmlConfigTests
 import org.springframework.security.config.BeanIds
 import org.springframework.security.web.FilterInvocation
 
+import javax.servlet.http.HttpServletRequest
+
 /**
  *
  * @author Rob Winch
@@ -29,11 +31,11 @@ abstract class AbstractHttpConfigTests extends AbstractXmlConfigTests {
     final int AUTO_CONFIG_FILTERS = 14;
 
     def httpAutoConfig(Closure c) {
-        xml.http('auto-config': 'true', c)
+        xml.http(['auto-config': 'true', 'use-expressions':false], c)
     }
 
     def httpAutoConfig(String matcher, Closure c) {
-        xml.http(['auto-config': 'true', 'request-matcher': matcher], c)
+        xml.http(['auto-config': 'true', 'use-expressions':false, 'request-matcher': matcher], c)
     }
 
     def interceptUrl(String path, String authz) {
@@ -72,4 +74,9 @@ abstract class AbstractHttpConfigTests extends AbstractXmlConfigTests {
 
         return new FilterInvocation(request, new MockHttpServletResponse(), new MockFilterChain());
     }
+
+    def basicLogin(HttpServletRequest request, String username="user",String password="password") {
+        def credentials = username + ":" + password
+        request.addHeader("Authorization", "Basic " + credentials.bytes.encodeBase64())
+    }
 }

config/src/test/groovy/org/springframework/security/config/http/CsrfConfigTests.groovy

@@ -152,14 +152,14 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
             springSecurityFilterChain.doFilter(request,response,chain)
         then: "sent to the login page"
             response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
-            response.redirectedUrl == "http://localhost/spring_security_login"
+            response.redirectedUrl == "http://localhost/login"
         when: "authenticate successfully"
             response = new MockHttpServletResponse()
             request = new MockHttpServletRequest(session: request.session)
-            request.servletPath = "/j_spring_security_check"
+            request.servletPath = "/login"
             request.setParameter(token.parameterName,token.token)
-            request.setParameter("j_username","user")
-            request.setParameter("j_password","password")
+            request.setParameter("username","user")
+            request.setParameter("password","password")
             request.method = "POST"
             springSecurityFilterChain.doFilter(request,response,chain)
         then: "sent to default success because we don't want csrf attempts made prior to authentication to pass"
@@ -186,14 +186,14 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
             springSecurityFilterChain.doFilter(request,response,chain)
         then: "sent to the login page"
             response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
-            response.redirectedUrl == "http://localhost/spring_security_login"
+            response.redirectedUrl == "http://localhost/login"
         when: "authenticate successfully"
             response = new MockHttpServletResponse()
             request = new MockHttpServletRequest(session: request.session)
-            request.servletPath = "/j_spring_security_check"
+            request.servletPath = "/login"
             request.setParameter(token.parameterName,token.token)
-            request.setParameter("j_username","user")
-            request.setParameter("j_password","password")
+            request.setParameter("username","user")
+            request.setParameter("password","password")
             request.method = "POST"
             springSecurityFilterChain.doFilter(request,response,chain)
         then: "sent to original URL since it was a GET"
@@ -279,9 +279,9 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
             when(repo.loadToken(any(HttpServletRequest))).thenReturn(token)
             request.setParameter(token.parameterName,token.token)
             request.method = "POST"
-            request.setParameter("j_username","user")
-            request.setParameter("j_password","password")
-            request.servletPath = "/j_spring_security_check"
+            request.setParameter("username","user")
+            request.setParameter("password","password")
+            request.servletPath = "/login"
         when:
             springSecurityFilterChain.doFilter(request,response,chain)
         then:
@@ -300,7 +300,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
             when(repo.loadToken(any(HttpServletRequest))).thenReturn(token)
             request.setParameter(token.parameterName,token.token)
             request.method = "POST"
-            request.servletPath = "/j_spring_security_logout"
+            request.servletPath = "/logout"
         when:
             springSecurityFilterChain.doFilter(request,response,chain)
         then:
@@ -315,7 +315,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
                 createAppContext()
                 login()
                 request.method = "GET"
-                request.requestURI = "/j_spring_security_logout"
+                request.requestURI = "/logout"
             when:
                 springSecurityFilterChain.doFilter(request,response,chain)
             then:

config/src/test/groovy/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.groovy

@@ -12,7 +12,7 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
 
     def 'form-login default login page'() {
         setup:
-            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/spring_security_login')
+            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/login')
             MockHttpServletResponse response = new MockHttpServletResponse()
             MockFilterChain chain = new MockFilterChain()
             httpAutoConfig {
@@ -22,11 +22,11 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
         when:
             springSecurityFilterChain.doFilter(request,response,chain)
         then:
-            response.getContentAsString() == """<html><head><title>Login Page</title></head><body onload='document.f.j_username.focus();'>
-<h3>Login with Username and Password</h3><form name='f' action='/j_spring_security_check' method='POST'>
+            response.getContentAsString() == """<html><head><title>Login Page</title></head><body onload='document.f.username.focus();'>
+<h3>Login with Username and Password</h3><form name='f' action='/login' method='POST'>
  <table>
-    <tr><td>User:</td><td><input type='text' name='j_username' value=''></td></tr>
-    <tr><td>Password:</td><td><input type='password' name='j_password'/></td></tr>
+    <tr><td>User:</td><td><input type='text' name='username' value=''></td></tr>
+    <tr><td>Password:</td><td><input type='password' name='password'/></td></tr>
     <tr><td colspan='2'><input name="submit" type="submit" value="Login"/></td></tr>
   </table>
 </form></body></html>"""
@@ -34,7 +34,7 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
 
     def 'form-login default login page custom attributes'() {
         setup:
-            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/spring_security_login')
+            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/login')
             MockHttpServletResponse response = new MockHttpServletResponse()
             MockFilterChain chain = new MockFilterChain()
             httpAutoConfig {
@@ -57,7 +57,7 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
 
     def 'openid-login default login page'() {
         setup:
-            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/spring_security_login')
+            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/login')
             MockHttpServletResponse response = new MockHttpServletResponse()
             MockFilterChain chain = new MockFilterChain()
             httpAutoConfig {
@@ -68,14 +68,14 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
         when:
             springSecurityFilterChain.doFilter(request,response,chain)
         then:
-            response.getContentAsString() == """<html><head><title>Login Page</title></head><body onload='document.f.j_username.focus();'>
-<h3>Login with Username and Password</h3><form name='f' action='/j_spring_security_check' method='POST'>
+            response.getContentAsString() == """<html><head><title>Login Page</title></head><body onload='document.f.username.focus();'>
+<h3>Login with Username and Password</h3><form name='f' action='/login' method='POST'>
  <table>
-    <tr><td>User:</td><td><input type='text' name='j_username' value=''></td></tr>
-    <tr><td>Password:</td><td><input type='password' name='j_password'/></td></tr>
+    <tr><td>User:</td><td><input type='text' name='username' value=''></td></tr>
+    <tr><td>Password:</td><td><input type='password' name='password'/></td></tr>
     <tr><td colspan='2'><input name="submit" type="submit" value="Login"/></td></tr>
   </table>
-</form><h3>Login with OpenID Identity</h3><form name='oidf' action='/j_spring_openid_security_check' method='POST'>
+</form><h3>Login with OpenID Identity</h3><form name='oidf' action='/login/openid' method='POST'>
  <table>
     <tr><td>Identity:</td><td><input type='text' size='30' name='openid_identifier'/></td></tr>
     <tr><td colspan='2'><input name="submit" type="submit" value="Login"/></td></tr>
@@ -85,7 +85,7 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
 
     def 'openid-login default login page custom attributes'() {
         setup:
-            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/spring_security_login')
+            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/login')
             MockHttpServletResponse response = new MockHttpServletResponse()
             MockFilterChain chain = new MockFilterChain()
             httpAutoConfig {
@@ -96,11 +96,11 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
         when:
             springSecurityFilterChain.doFilter(request,response,chain)
         then:
-            response.getContentAsString() == """<html><head><title>Login Page</title></head><body onload='document.f.j_username.focus();'>
-<h3>Login with Username and Password</h3><form name='f' action='/j_spring_security_check' method='POST'>
+            response.getContentAsString() == """<html><head><title>Login Page</title></head><body onload='document.f.username.focus();'>
+<h3>Login with Username and Password</h3><form name='f' action='/login' method='POST'>
  <table>
-    <tr><td>User:</td><td><input type='text' name='j_username' value=''></td></tr>
-    <tr><td>Password:</td><td><input type='password' name='j_password'/></td></tr>
+    <tr><td>User:</td><td><input type='text' name='username' value=''></td></tr>
+    <tr><td>Password:</td><td><input type='password' name='password'/></td></tr>
     <tr><td colspan='2'><input name="submit" type="submit" value="Login"/></td></tr>
   </table>
 </form><h3>Login with OpenID Identity</h3><form name='oidf' action='/login_custom' method='POST'>

config/src/test/groovy/org/springframework/security/config/http/HttpConfigTests.groovy

@@ -0,0 +1,62 @@
+/*
+ * Copyright 2002-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.security.config.http
+
+import org.springframework.mock.web.MockFilterChain
+import org.springframework.mock.web.MockHttpServletRequest
+import org.springframework.mock.web.MockHttpServletResponse
+import org.springframework.security.access.AccessDeniedException
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
+import org.springframework.security.core.Authentication
+import org.springframework.security.core.authority.AuthorityUtils
+import org.springframework.security.core.context.SecurityContextImpl
+import org.springframework.security.web.access.AccessDeniedHandler
+import org.springframework.security.web.context.HttpRequestResponseHolder
+import org.springframework.security.web.context.HttpSessionSecurityContextRepository
+import org.springframework.security.web.csrf.CsrfFilter
+import org.springframework.security.web.csrf.CsrfToken
+import org.springframework.security.web.csrf.CsrfTokenRepository
+import org.springframework.security.web.csrf.DefaultCsrfToken
+import org.springframework.security.web.util.matcher.RequestMatcher
+import org.springframework.web.servlet.support.RequestDataValueProcessor
+import spock.lang.Unroll
+
+import javax.servlet.http.HttpServletRequest
+import javax.servlet.http.HttpServletResponse
+
+import static org.mockito.Matchers.any
+import static org.mockito.Matchers.eq
+import static org.mockito.Mockito.*
+
+/**
+ *
+ * @author Rob Winch
+ */
+class HttpConfigTests extends AbstractHttpConfigTests {
+    MockHttpServletRequest request = new MockHttpServletRequest('GET','/secure')
+    MockHttpServletResponse response = new MockHttpServletResponse()
+    MockFilterChain chain = new MockFilterChain()
+
+    def 'http minimal configuration works'() {
+        setup:
+        xml.http() {}
+        createAppContext("""<user-service>
+        <user name="user" password="password" authorities="ROLE_USER" />
+    </user-service>""")
+        when: 'request protected URL'
+        springSecurityFilterChain.doFilter(request,response,chain)
+        then: 'sent to login page'
+        response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
+        response.redirectedUrl == 'http://localhost/login'
+    }
+}

config/src/test/groovy/org/springframework/security/config/http/HttpOpenIDConfigTests.groovy

@@ -34,7 +34,7 @@ class OpenIDConfigTests extends AbstractHttpConfigTests {
         def ap = etf.getAuthenticationEntryPoint();
 
         expect:
-        ap.loginFormUrl == "/spring_security_login"
+        ap.loginFormUrl == "/login"
         // Default login filter should be present since we haven't specified any login URLs
         getFilter(DefaultLoginPageGeneratingFilter) != null
     }
@@ -75,9 +75,10 @@ class OpenIDConfigTests extends AbstractHttpConfigTests {
     def openIDAndRememberMeWorkTogether() {
         xml.debug()
         xml.http() {
-            interceptUrl('/**', 'ROLE_NOBODY')
+            interceptUrl('/**', 'denyAll')
             'openid-login'()
             'remember-me'()
+            'csrf'(disabled:true)
         }
         createAppContext()
 
@@ -107,16 +108,16 @@ class OpenIDConfigTests extends AbstractHttpConfigTests {
         request.setServletPath("/something.html")
         fc.doFilter(request, response, new MockFilterChain())
         then: "Redirected to login"
-        response.getRedirectedUrl().endsWith("/spring_security_login")
+        response.getRedirectedUrl().endsWith("/login")
         when: "Login page is requested"
-        request.setServletPath("/spring_security_login")
-        request.setRequestURI("/spring_security_login")
+        request.setServletPath("/login")
+        request.setRequestURI("/login")
         response = new MockHttpServletResponse()
         fc.doFilter(request, response, new MockFilterChain())
         then: "Remember-me choice is added to page"
         response.getContentAsString().contains(AbstractRememberMeServices.DEFAULT_PARAMETER)
         when: "Login is submitted with remember-me selected"
-        request.servletPath = "/j_spring_openid_security_check"
+        request.servletPath = "/login/openid"
         request.setParameter(OpenIDAuthenticationFilter.DEFAULT_CLAIMED_IDENTITY_FIELD, "http://hey.openid.com/")
         request.setParameter(AbstractRememberMeServices.DEFAULT_PARAMETER, "on")
         response = new MockHttpServletResponse();

config/src/test/groovy/org/springframework/security/config/http/InterceptUrlConfigTests.groovy

@@ -108,7 +108,7 @@ class InterceptUrlConfigTests extends AbstractHttpConfigTests {
            MockHttpServletRequest request = new MockHttpServletRequest(method:'GET')
            MockHttpServletResponse response = new MockHttpServletResponse()
            MockFilterChain chain = new MockFilterChain()
-           xml.http() {
+           xml.http('use-expressions':false) {
                'http-basic'()
                'intercept-url'(pattern: '/**', 'method':'PATCH',access: 'ROLE_ADMIN')
                csrf(disabled:true)

config/src/test/groovy/org/springframework/security/config/http/MiscHttpConfigTests.groovy

@@ -609,10 +609,10 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
             anonymous(enabled: 'false')
         }
         createAppContext()
-        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/j_spring_security_check");
-        request.setServletPath("/j_spring_security_check");
-        request.addParameter("j_username", "bob");
-        request.addParameter("j_password", "bobspassword");
+        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/login");
+        request.setServletPath("/login");
+        request.addParameter("username", "bob");
+        request.addParameter("password", "bobspassword");
         then: "App context creation and login request succeed"
         DebugFilter debugFilter = appContext.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN);
         debugFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());

config/src/test/groovy/org/springframework/security/config/http/MultiHttpBlockConfigTests.groovy

@@ -107,8 +107,8 @@ class MultiHttpBlockConfigTests extends AbstractHttpConfigTests {
             MockHttpServletRequest request2 = new MockHttpServletRequest()
             MockHttpServletResponse response2 = new MockHttpServletResponse()
             MockFilterChain chain2 = new MockFilterChain()
-            request2.servletPath = "/j_spring_security_check"
-            request2.requestURI = "/j_spring_security_check"
+            request2.servletPath = "/login"
+            request2.requestURI = "/login"
             request2.method = 'POST'
             springSecurityFilterChain.doFilter(request2,response2,chain2)
         then:

config/src/test/groovy/org/springframework/security/config/http/PlaceHolderAndELConfigTests.groovy

@@ -46,7 +46,7 @@ class PlaceHolderAndELConfigTests extends AbstractHttpConfigTests {
         System.setProperty("auth.failure", "/authFailure");
 
         xml.http(pattern: '${login.page}', security: 'none')
-        xml.http {
+        xml.http('use-expressions':false) {
             interceptUrl('${secure.Url}', '${secure.role}')
             'form-login'('login-page':'${login.page}', 'default-target-url': '${default.target}',
                 'authentication-failure-url':'${auth.failure}');
@@ -66,7 +66,7 @@ class PlaceHolderAndELConfigTests extends AbstractHttpConfigTests {
         System.setProperty("default.target", "/defaultTarget");
         System.setProperty("auth.failure", "/authFailure");
 
-        xml.http {
+        xml.http('use-expressions':false) {
             interceptUrl("#{systemProperties['secure.url']}", "#{systemProperties['secure.role']}")
             'form-login'('login-page':"#{systemProperties['login.page']}", 'default-target-url': "#{systemProperties['default.target']}",
                 'authentication-failure-url':"#{systemProperties['auth.failure']}");

config/src/test/groovy/org/springframework/security/config/http/SessionManagementConfigTests.groovy

@@ -285,10 +285,10 @@ class SessionManagementConfigTests extends AbstractHttpConfigTests {
 
             MockHttpServletRequest request = new MockHttpServletRequest();
             request.getSession();
-            request.servletPath = "/j_spring_security_check"
+            request.servletPath = "/login"
             request.setMethod("POST");
-            request.setParameter("j_username", "user");
-            request.setParameter("j_password", "password");
+            request.setParameter("username", "user");
+            request.setParameter("password", "password");
 
             SessionAuthenticationStrategy sessionAuthStrategy = appContext.getBean('ss',SessionAuthenticationStrategy)
             FilterChainProxy springSecurityFilterChain = appContext.getBean(FilterChainProxy)

config/src/test/java/org/springframework/security/config/http/FilterSecurityMetadataSourceBeanDefinitionParserTests.java

@@ -1,6 +1,8 @@
 package org.springframework.security.config.http;
 
-import static org.junit.Assert.*;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
 
 import java.util.Collection;
 
@@ -42,7 +44,7 @@ public class FilterSecurityMetadataSourceBeanDefinitionParserTests {
     @Test
     public void parsingMinimalConfigurationIsSuccessful() {
         setContext(
-                "<filter-security-metadata-source id='fids'>" +
+                "<filter-security-metadata-source id='fids' use-expressions='false'>" +
                 "   <intercept-url pattern='/**' access='ROLE_A'/>" +
                 "</filter-security-metadata-source>");
         DefaultFilterInvocationSecurityMetadataSource fids = (DefaultFilterInvocationSecurityMetadataSource) appContext.getBean("fids");
@@ -54,7 +56,7 @@ public class FilterSecurityMetadataSourceBeanDefinitionParserTests {
     @Test
     public void expressionsAreSupported() {
         setContext(
-                "<filter-security-metadata-source id='fids' use-expressions='true'>" +
+                "<filter-security-metadata-source id='fids'>" +
                 "   <intercept-url pattern='/**' access=\"hasRole('ROLE_A')\" />" +
                 "</filter-security-metadata-source>");
 
@@ -72,7 +74,7 @@ public class FilterSecurityMetadataSourceBeanDefinitionParserTests {
         System.setProperty("secure.role", "ROLE_A");
         setContext(
                 "<b:bean class='org.springframework.beans.factory.config.PropertyPlaceholderConfigurer'/>" +
-                "<filter-security-metadata-source id='fids'>" +
+                "<filter-security-metadata-source id='fids' use-expressions='false'>" +
                 "   <intercept-url pattern='${secure.url}' access='${secure.role}'/>" +
                 "</filter-security-metadata-source>");
         DefaultFilterInvocationSecurityMetadataSource fids = (DefaultFilterInvocationSecurityMetadataSource) appContext.getBean("fids");
@@ -85,10 +87,10 @@ public class FilterSecurityMetadataSourceBeanDefinitionParserTests {
     @Test
     public void parsingWithinFilterSecurityInterceptorIsSuccessful() {
         setContext(
-                "<http auto-config='true'/>" +
+                "<http auto-config='true' use-expressions='false'/>" +
                 "<b:bean id='fsi' class='org.springframework.security.web.access.intercept.FilterSecurityInterceptor' autowire='byType'>" +
                 "   <b:property name='securityMetadataSource'>" +
-                "       <filter-security-metadata-source>" +
+                "       <filter-security-metadata-source use-expressions='false'>" +
                 "           <intercept-url pattern='/secure/extreme/**' access='ROLE_SUPERVISOR'/>" +
                 "           <intercept-url pattern='/secure/**' access='ROLE_USER'/>" +
                 "           <intercept-url pattern='/**' access='ROLE_USER'/>" +

config/src/test/java/org/springframework/security/config/http/SessionManagementConfigServlet31Tests.java

@@ -98,10 +98,10 @@ public class SessionManagementConfigServlet31Tests {
         Method method = mock(Method.class);
         MockHttpServletRequest request = new MockHttpServletRequest();
         request.getSession();
-        request.setServletPath("/j_spring_security_check");
+        request.setServletPath("/login");
         request.setMethod("POST");
-        request.setParameter("j_username", "user");
-        request.setParameter("j_password", "password");
+        request.setParameter("username", "user");
+        request.setParameter("password", "password");
         when(ReflectionUtils.findMethod(HttpServletRequest.class, "changeSessionId")).thenReturn(method);
 
         loadContext("<http>\n" +
@@ -124,10 +124,10 @@ public class SessionManagementConfigServlet31Tests {
         Method method = mock(Method.class);
         MockHttpServletRequest request = new MockHttpServletRequest();
         request.getSession();
-        request.setServletPath("/j_spring_security_check");
+        request.setServletPath("/login");
         request.setMethod("POST");
-        request.setParameter("j_username", "user");
-        request.setParameter("j_password", "password");
+        request.setParameter("username", "user");
+        request.setParameter("password", "password");
         when(ReflectionUtils.findMethod(HttpServletRequest.class, "changeSessionId")).thenReturn(method);
 
         loadContext("<http>\n" +