Spring Security Custom Filter (Change Password) -

i'm using spring security securing http requests website. primary usage securing pages such user redirected login page when trying access pages.

however, have further requirement. in model, can flag user's password being temporary such that, when login, should automatically forced change password. once password changed, should forwarded on page trying access.

has used spring security purpose? need create own custom filter?

thanks,

andrew

in spring security 3.0 can implement custom authenticationsuccesshandler.

in handler can redirect user temporary password password change page instead of requested page. after password changed, may redirect user requested page using savedrequestawareauthenticationsuccesshandler, default handler implementation.

public class myhandler implements authenticationsuccesshandler {     private authenticationsuccesshandler target = new savedrequestawareauthenticationsuccesshandler();      public void onauthenticationsuccess(httpservletrequest request,         httpservletresponse response, authentication auth) {         if (hastemporarypassword(auth)) {             response.sendredirect("/changepassword");         } else {             target.onauthenticationsuccess(request, response, auth);         }     }      public void proceed(httpservletrequest request,          httpservletresponse response, authentication auth) {         target.onauthenticationsuccess(request, response, auth);     } }  @controller("/changepassword") public class changepasswordcontroller {      @autowired     private myhandler handler;      @requestmapping(method = post)     public void changepassword(httpservletrequest request,          httpservletresponse response,         @requestparam(name = "newpassword") string newpassword) {          // handle password change         ...          // proceed secured page         handler.proceed(request, response, auth);             }      // form display method, etc     ... }