Spring Security 6 & JWT Authentication · Lección

Manejador personalizado de éxito OAuth2

Desarrolle un manejador de éxito personalizado para procesar la información del usuario después de una autenticación OAuth2 correcta.

Manejador personalizado de éxito OAuth2 es una lección gratuita de Spring Security 6 & JWT Authentication en CoddyKit. Esta es la lección 3 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de Spring Security 6 & JWT Authentication, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

Partes de esta lección aún no han sido traducidas y se muestran en inglés.

Intro to OAuth2 Success Handlers

Welcome to our lesson on custom OAuth2 success handlers! After a user successfully logs in via an OAuth2 provider (like Google or GitHub), Spring Security needs to know what to do next.

By default, it handles basic redirection. But what if you need to perform custom actions, like saving user details or updating their profile? That's where custom success handlers come in!

Default OAuth2 Success Flow

When a user successfully authenticates with an OAuth2 provider, Spring Security's default behavior is quite straightforward:

It extracts user details (like name, email) from the provider's response.
It creates an OAuth2AuthenticationToken.
It redirects the user to the application's root URL (or a previously requested URL).

This is often enough for simple integrations, but real-world apps usually need more.

Why Customize Success Handling?

Customizing the success handler allows you to:

Store User Data: Save new users or update existing ones in your application's database.
Generate Tokens: Create custom session tokens or JWTs after OAuth2 login.
Redirect Dynamically: Send users to different pages based on their role or status.
Logging & Auditing: Log successful logins for security monitoring.

It gives you fine-grained control over the post-authentication process.

The AuthenticationSuccessHandler

Spring Security provides the AuthenticationSuccessHandler interface. You implement this interface to define custom logic for successful authentication events.

Its core method is onAuthenticationSuccess, which gets called after authentication passes.

public interface AuthenticationSuccessHandler {
  void onAuthenticationSuccess(
    HttpServletRequest request,
    HttpServletResponse response,
    Authentication authentication
  ) throws IOException, ServletException;
}

Building a Simple Custom Handler

Let's create a basic custom handler that just logs the successful authentication and then redirects. We'll implement the AuthenticationSuccessHandler interface.

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.core.Authentication;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
import org.springframework.stereotype.Component;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

@Component
public class CustomOAuth2SuccessHandler implements AuthenticationSuccessHandler {

    private static final Logger logger = LoggerFactory.getLogger(CustomOAuth2SuccessHandler.class);

    @Override
    public void onAuthenticationSuccess(
        HttpServletRequest request,
        HttpServletResponse response,
        Authentication authentication) throws IOException, ServletException {

        logger.info("OAuth2 login successful for user: " + authentication.getName());
        // Default redirect to home page
        response.sendRedirect("/");
    }
}

Configuring the Custom Handler

To make Spring Security use our custom handler, we need to configure it in our SecurityFilterChain bean. We'll use the oauth2Login() method.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final AuthenticationSuccessHandler customOAuth2SuccessHandler;

    public SecurityConfig(AuthenticationSuccessHandler customOAuth2SuccessHandler) {
        this.customOAuth2SuccessHandler = customOAuth2SuccessHandler;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .successHandler(customOAuth2SuccessHandler) // <--- Register our handler
            );
        return http.build();
    }
}

Accessing User Details

Inside onAuthenticationSuccess, the Authentication object holds the authenticated principal. For OAuth2, this principal will be an OAuth2User.

You can cast it to OAuth2User to access provider-specific attributes like email, name, or unique IDs (e.g., Google ID).

import org.springframework.security.oauth2.core.user.OAuth2User;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;

// Inside onAuthenticationSuccess method:

public void onAuthenticationSuccess(
    HttpServletRequest request,
    HttpServletResponse response,
    Authentication authentication) throws IOException, ServletException {

    if (authentication instanceof OAuth2AuthenticationToken) {
        OAuth2AuthenticationToken oauthToken = (OAuth2AuthenticationToken) authentication;
        OAuth2User oauth2User = oauthToken.getPrincipal();

        String email = oauth2User.getAttribute("email");
        String name = oauth2User.getAttribute("name");
        String provider = oauthToken.getAuthorizedClientRegistrationId();

        logger.info("User logged in: " + name + " from " + provider + " with email: " + email);
        // ... further processing
    }
    response.sendRedirect("/");
}

Practical: Saving User to DB

A common use case is to save or update user information in your database after a successful OAuth2 login. Here's a simplified example:

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.core.user.OAuth2User;
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
import org.springframework.stereotype.Component;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

// Assume you have a UserService and User entity
// public interface UserService { User saveOrUpdateUser(OAuth2User oauth2User, String provider); }
// public class User { private String email; private String name; /*...*/ }

@Component
public class DatabaseOAuth2SuccessHandler implements AuthenticationSuccessHandler {

    private static final Logger logger = LoggerFactory.getLogger(DatabaseOAuth2SuccessHandler.class);
    // private final UserService userService; // Inject your user service

    // public DatabaseOAuth2SuccessHandler(UserService userService) {
    //     this.userService = userService;
    // }

    @Override
    public void onAuthenticationSuccess(
        HttpServletRequest request,
        HttpServletResponse response,
        Authentication authentication) throws IOException, ServletException {

        if (authentication instanceof OAuth2AuthenticationToken) {
            OAuth2AuthenticationToken oauthToken = (OAuth2AuthenticationToken) authentication;
            OAuth2User oauth2User = oauthToken.getPrincipal();
            String provider = oauthToken.getAuthorizedClientRegistrationId();

            logger.info("Processing OAuth2 user from " + provider);
            // User savedUser = userService.saveOrUpdateUser(oauth2User, provider);
            // logger.info("User saved/updated: " + savedUser.getEmail());
        }
        response.sendRedirect("/");
    }
}

Custom Redirection Logic

The onAuthenticationSuccess method also allows you to control the redirection after login. You can redirect users to a specific dashboard, a profile setup page, or back to the page they were trying to access.

You can use response.sendRedirect("/some-path") or integrate with Spring's RedirectStrategy.

request.getRequestURI(): Get the original request URI.
response.sendRedirect("/"): Redirect to the root.
new DefaultRedirectStrategy().sendRedirect(request, response, "/dashboard"): More robust redirection.

Quick Check: Success Handlers

Which of the following are valid reasons to implement a custom AuthenticationSuccessHandler for OAuth2 in Spring Security?

Recap: Custom Success Handlers

In this lesson, we explored how to customize the post-authentication process for OAuth2 logins using Spring Security's AuthenticationSuccessHandler.

We learned its purpose: extending default behavior for user management, redirection, and auditing.
We saw how to implement the onAuthenticationSuccess method.
We configured our custom handler in the SecurityFilterChain.
We understood how to access OAuth2User details and perform actions like saving users to a database.

Custom success handlers provide powerful control over your application's user experience and data integration after an OAuth2 login.

Preguntas frecuentes

¿La lección «Manejador personalizado de éxito OAuth2» es gratis?

Sí — el texto completo de «Manejador personalizado de éxito OAuth2» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de Spring Security 6 & JWT Authentication, actualiza a CoddyKit PRO. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

¿Qué aprenderé en «Manejador personalizado de éxito OAuth2»?

Desarrolle un manejador de éxito personalizado para procesar la información del usuario después de una autenticación OAuth2 correcta. Practicas Spring Security 6 & JWT Authentication con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.

¿Necesito experiencia previa para empezar Spring Security 6 & JWT Authentication?

No se requiere experiencia previa. Spring Security 6 & JWT Authentication en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 3 de 4.

¿Cuánto tiempo toma la lección «Manejador personalizado de éxito OAuth2»?

La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.

¿Puedo escribir y ejecutar código en esta lección de Spring Security 6 & JWT Authentication?

Sí. Cada lección de Spring Security 6 & JWT Authentication incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.

Todas las lecciones de este curso

← Volver a Spring Security 6 & JWT Authentication