Spring Security authentication failure page not work - spring-mvc

Question

I use spring-security to manage user authentication in my spring-mvc project,but now I found when I typed a wrong username or password and login,it will show a HTTP Status 401,Authentication Failed:Bad credentials page on my web browser listed in the below.However I have configured the authentication-failure-url in my spring-security.xml file,but it doesn't work,I do not know why.
Could anyone can help me?
This is my error page that the browser shown:
This is my spring-security.xml configuration code:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<security:http pattern="/interface/**" security="none"/>
<security:http pattern="/forward.html" security="none"/>
<security:http pattern="/js/**" security="none"/>
<security:http pattern="/css/**" security="none"/>
<security:http pattern="/images/**" security="none"/>
<security:http pattern="/file/**" security="none"/>
<security:http pattern="/favicon.ico" security="none"/>
<security:http pattern="/login**" security="none" />
<security:http auto-config="true" access-denied-page="/accessDenied" use-expressions="true">
<security:intercept-url pattern="/login**" access="isAnonymous()" /> -->
<security:intercept-url pattern="/common/exceptionInfo.jsp" access="isAnonymous()" />
<security:intercept-url pattern="/**" access="isFullyAuthenticated()" />
<security:session-management session-authentication-error-url="/login" invalid-session-url="/login">
<security:concurrency-control session-registry-ref="sessionRegistry" expired-url="/login"/>
</security:session-management>
<security:custom-filter before="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
<security:custom-filter before="FORM_LOGIN_FILTER" ref="authFilter" />
<security:custom-filter before="FILTER_SECURITY_INTERCEPTOR" ref="securityFilter"/>
<security:form-login login-page="/login" authentication-failure-url="/login?failure"
authentication-details-source-ref="customAuthenticationDetailsSource"
authentication-success-handler-ref="customAuthenticationSuccessHandler"/>
<security:logout invalidate-session="true" logout-url="/logout" success-handler-ref="customLogoutSuccessHandler"/>
</security:http>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref="customAuthenticationProvider"/>
</security:authentication-manager>
<bean id="customUserDetailsService" class="com.lucumt.security.CustomUserDetailsService"/>
<bean id="customAuthenticationProvider" class="com.lucumt.security.CustomAuthenticationProvider">
<property name="userDetailsService" ref="customUserDetailsService"/>
</bean>
<bean id="customAuthenticationDetailsSource" class="com.lucumt.security.CustomAuthenticationDetailsSource"/>
<bean id="customAuthenticationSuccessHandler" class="com.lucumt.security.CustomAuthenticationSuccessHandler">
<property name="defaultTargetUrl" value="/home"/>
</bean>
<bean id="customLogoutSuccessHandler" class="com.lucumt.security.CustomLogoutSuccessHandler">
<property name="defaultTargetUrl" value="/login"/>
</bean>
<bean id="securityFilter" class="com.lucumt.security.CustomFilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="accessDecisionManager" ref="accessDecisionManager"/>
<property name="securityMetadataSource" ref="securityMetadataSource"/>
</bean>
<bean id="accessDecisionManager" class="com.lucumt.security.CustomAccessDecisionManager"/>
<bean id="securityMetadataSource" class="com.lucumt.security.CustomInvocationSecurityMetadataSource">
<constructor-arg ref="authorityDao"/>
</bean>
<bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">
<property name="sessionRegistry" ref="sessionRegistry" />
<property name="expiredUrl" value="/login?times" />
</bean>
<bean id="authFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
<property name="sessionAuthenticationStrategy" ref="sessionStrategy" />
<property name="authenticationManager" ref="authenticationManager" />
<property name="authenticationDetailsSource" ref="customAuthenticationDetailsSource"/>
<property name="authenticationSuccessHandler" ref="customAuthenticationSuccessHandler"/>
</bean>
<bean id="sessionStrategy" class="com.lucumt.security.CustomConcurrentSessionControlStrategy">
<constructor-arg ref="sessionRegistry"/>
</bean>
<bean id="authorityDao" class="com.lucumt.dao.impl.AuthorityDaoImpl"/>
<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>
</beans>
As you can seen,I have configured the authentication-failure-urlas below,but it doesn't work!
<security:form-login login-page="/login" authentication-failure-url="/login?failure"
authentication-details-source-ref="customAuthenticationDetailsSource"
authentication-success-handler-ref="customAuthenticationSuccessHandler"/>
However,if I remove the session-management configuration as below,then the authentication-failure-url will work!
<security:session-management session-authentication-error-url="/login" invalid-session-url="/login">
<security:concurrency-control session-registry-ref="sessionRegistry" expired-url="/login"/>
</security:session-management>
<security:custom-filter before="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
<security:custom-filter before="FORM_LOGIN_FILTER" ref="authFilter" />
The reason why I add session-management is that I want to limit the number of user that can log in at the same time via Java code.
Now that I want to perseve session-management and also want to the authentication-failure-url work,could anyone help me?Thanks in advance!

Answer 1

Place this in your Dispatcher-servlet.xml
<bean
class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
<property name="exceptionMappings">
<props>
<prop key="java.lang.Exception">login/login</prop>
</props>
</property>
</bean>
Its Resolve Your Problem completely.