In this tutorial, we will show you how to integrate Spring Security with a Spring MVC web application to secure a URL access. After implementing Spring Security, to access the content of an “admin” page, users need to key in the correct “username” and “password”.

Technologies used :

  1. Spring 3.2.8.RELEASE
  2. Spring Security 3.2.3.RELEASE
  3. Eclipse 4.2
  4. JDK 1.6
  5. Maven 3
Spring Security 3.0 requires Java 5.0 Runtime Environment or higher

1. Project Demo

2. Directory Structure

Review the final directory structure of this tutorial.


3. Spring Security Dependencies

To use Spring security, you need spring-security-web and spring-security-config.

		<!-- Spring dependencies -->
		<!-- Spring Security -->
		<!-- jstl for jsp page -->

4. Spring MVC Web Application

A simple controller :

  1. If URL = /welcome or / , return hello page.
  2. If URL = /admin , return admin page.

Later, we will show you how to use Spring Security to secure the “/admin” URL with a user login form.
package com.mkyong.web.controller;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.servlet.ModelAndView;
public class HelloController {
	@RequestMapping(value = { "/", "/welcome**" }, method = RequestMethod.GET)
	public ModelAndView welcomePage() {
		ModelAndView model = new ModelAndView();
		model.addObject("title", "Spring Security Hello World");
		model.addObject("message", "This is welcome page!");
		return model;
	@RequestMapping(value = "/admin**", method = RequestMethod.GET)
	public ModelAndView adminPage() {
		ModelAndView model = new ModelAndView();
		model.addObject("title", "Spring Security Hello World");
		model.addObject("message", "This is protected page!");
		return model;

Two JSP pages.

<%@page session="false"%>
	<h1>Title : ${title}</h1>	
	<h1>Message : ${message}</h1>	
<%@taglib prefix="c" uri=""%>
<%@page session="true"%>
	<h1>Title : ${title}</h1>
	<h1>Message : ${message}</h1>
	<c:if test="${ != null}">
	   <h2>Welcome : ${} 
           | <a href="<c:url value="/j_spring_security_logout" />" > Logout</a></h2>  
<beans xmlns=""
	xsi:schemaLocation="    ">
	<context:component-scan base-package="com.mkyong.*" />
	  <property name="prefix">
	  <property name="suffix">

5. Spring Security : User Authentication

Create a Spring Security XML file.

<beans:beans xmlns=""
	<http auto-config="true">
		<intercept-url pattern="/admin**" access="ROLE_USER" />
		<user name="mkyong" password="123456" authorities="ROLE_USER" />

It tells, only user “mkyong” is allowed to access the /admin URL.

6. Integrate Spring Security

To integrate Spring security with a Spring MVC web application, just declares DelegatingFilterProxy as a servlet filter to intercept any incoming request.

<web-app id="WebApp_ID" version="2.4"
	<display-name>Spring MVC Application</display-name>
	<!-- Spring MVC -->
        <!-- Loads Spring Security config file -->
	<!-- Spring Security -->

7. Demo

That’s all, but wait… where’s the login form? No worry, if you do not define any custom login form, Spring will create a simple login form automatically.

Custom Login Form
Read this “Spring Security form login example” to understand how to create a custom login form in Spring Security.

1. Welcome Page – http://localhost:8080/spring-security-helloworld-xml/welcome


2. Try to access /admin page, Spring Security will intercept the request and redirect to /spring_security_login, and a predefined login form is displayed.


3. If username and password is incorrect, error messages will be displayed, and Spring will redirect to this URL /spring_security_login?login_error.


4. If username and password are correct, Spring will redirect the request to the original requested URL and display the page.


Download Source Code

Download it – (9 KB)


  1. Spring Security Official Site
  2. Spring 3 MVC hello world example
  3. Spring Security form login example (authentication)
Tags :
Founder of and, love Java and open source stuff. Follow him on Twitter, or befriend him on Facebook or Google Plus. If you like my tutorials, consider make a donation to these charities.

Related Posts

Popular Posts