Spring custom authentication filter and provider not invoking controller method
<p>I'm trying to implement a custom authentication logic with latest version of Spring Boot, Web and Security, but I'm struggling with some issues. I was trying out many solutions in similar questions/tutorials without success or understanding what actually happens.</p>

<p>I'm creating a REST application with stateless authentication, i.e. there is a REST endpoint (/web/auth/login) that expects username and password and returns a string token, which is then used in all the other REST endpoints (/api/**) to identify the user. I need to implement a custom solution as authentication will become more complex in the future and I would like to understand the basics of Spring Security.</p>

<p>To achieve the token authentication, I'm creating a customized filter and provider:</p>

<p>The filter:</p>

<pre><code>public class TokenAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

public TokenAuthenticationFilter() {
    super(new AntPathRequestMatcher("/api/**", "GET"));
}

@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
    String token = request.getParameter("token");
    if (token == null || token.length() == 0) {
        throw new BadCredentialsException("Missing token");
    }

    UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(token, null);

    return getAuthenticationManager().authenticate(authenticationToken);
}
}
</code></pre>

<p>The provider:</p>

<pre><code>@Component
public class TokenAuthenticationProvider implements AuthenticationProvider {
@Autowired
private AuthenticationTokenManager tokenManager;

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    String token = (String)authentication.getPrincipal();
    return tokenManager.getAuthenticationByToken(token);
}

@Override
public boolean supports(Class&lt;?&gt; authentication) {
    return UsernamePasswordAuthenticationToken.class.equals(authentication);
}
}
</code></pre>

<p>The config:</p>

<pre><code>@EnableWebSecurity
@Order(1)
public class TokenAuthenticationSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private TokenAuthenticationProvider authProvider;

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.antMatcher("/api/**")
    .csrf().disable()
    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
    .and().addFilterBefore(authenticationFilter(), BasicAuthenticationFilter.class);
}

@Bean
public TokenAuthenticationFilter authenticationFilter() throws Exception {
    TokenAuthenticationFilter tokenProcessingFilter = new TokenAuthenticationFilter();
    tokenProcessingFilter.setAuthenticationManager(authenticationManager());
    return tokenProcessingFilter;
}

@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authProvider);
}
}
</code></pre>

<p>The AuthenticationTokenManager used in the provider (and also in the login process):</p>

<pre><code>@Component
public class AuthenticationTokenManager {
private Map&lt;String, AuthenticationToken&gt; tokens;

public AuthenticationTokenManager() {
    tokens = new HashMap&lt;&gt;();
}

private String generateToken(AuthenticationToken authentication) {
    return UUID.randomUUID().toString();
}

public String addAuthentication(AuthenticationToken authentication) {
    String token = generateToken(authentication);
    tokens.put(token, authentication);
    return token;
}

public AuthenticationToken getAuthenticationByToken(String token) {
    return tokens.get(token);
}
</code></pre>

<p>}</p>

<p><strong>What happens:</strong>
I'm appending a valid token in the request to "/api/bla" (which is a REST controller returning some Json). The filter and provider both get invoked. <strong>The problem is</strong>, the browser is redirected to "/" instead of invoking the REST controller's requested method. This seems to happen in SavedRequestAwareAuthenticationSuccessHandler, but why is this handler being used?</p>

<p><strong>I tried</strong></p>

<ul>
<li>to implement an empty success handler, resulting in a 200 status code and still not invoking the controller</li>
<li>to do authentication in a simple GenericFilterBean and setting the authentication object via SecurityContextHolder.getContext().setAuthentication(authentication) which results in a "Bad credentials" error page.</li>
</ul>

<p>I would like to understand why my controller is not being called after I authenticated the token. Besides that, is there a "Spring" way to store the token instead of storing it in a Map, like a custom implementation of SecurityContextRepository?</p>

<p>I really appreciate any hint!</p>