Spring Boot エラーメッセージをうまく画面に表示できない

Question

実現したいこと

Spring Boot 3.0.8とSpring Security6を使用してログイン処理失敗時に、エラーメッセージを画面に表示させたい。かつ、画面更新時にはそのエラーメッセージがなくなっているようにしたい。

発生している問題・エラーメッセージ

※下記はユーザー名は正しいがパスワードが間違った入力の場合のコンソール出力です。
コンソールを見ると/login-errorにPOSTリクエストが来た後に、/loginにリダイレクトされてしまい結果、画面にエラーメッセージが表示されずじまいといった形になってしまいます。

o.s.security.web.FilterChainProxy        : Securing POST /login
o.s.s.a.dao.DaoAuthenticationProvider    : Failed to authenticate since password does not match stored value
o.s.security.web.FilterChainProxy        : Securing POST /login-error
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to com.example.controllers.RootController#onAuthenticationErrorPost(AuthenticationException, Model)
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to com.example.controllers.RootController#onAuthenticationErrorPost(AuthenticationException, Model)
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to com.example.controllers.RootController#onAuthenticationErrorPost(AuthenticationException, Model)
o.s.s.w.a.AnonymousAuthenticationFilter  : Set SecurityContextHolder to anonymous SecurityContext
o.s.s.web.DefaultRedirectStrategy        : Redirecting to http://localhost:18080/login
o.s.security.web.FilterChainProxy        : Securing GET /login
o.s.security.web.FilterChainProxy        : Secured GET /login
o.s.web.servlet.DispatcherServlet        : GET "/login", parameters={}
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to com.example.crewsync.controllers.RootController#login()
o.s.w.s.v.ContentNegotiatingViewResolver : Selected 'text/html' given [text/html, application/xhtml+xml, image/avif, image/webp, image/apng, application/xml;q=0.9, */*;q=0.8, application/signed-exchange;v=b3;q=0.7]
o.s.web.servlet.DispatcherServlet        : Completed 200 OK

該当のソースコード

package com.example.conf;

import org.springframework.boot.autoconfigure.security.servlet.PathRequest;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.ForwardAuthenticationFailureHandler;

/**
 * Spring Security設定クラスです
 */
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.formLogin(login -> login
                .loginPage("/login")
                .loginProcessingUrl("/login")
                .defaultSuccessUrl("/")
                .failureHandler(new ForwardAuthenticationFailureHandler("/login-error"))
                .usernameParameter("email")
                .passwordParameter("password")
                .permitAll())
                .logout(logout -> logout
                        .logoutSuccessUrl("/login")
                        .invalidateHttpSession(true)
                        .deleteCookies("JSESSIONID"))
                .authorizeHttpRequests(authz -> authz
                        .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
                        .requestMatchers("/img/**").permitAll()
                        .requestMatchers("/").permitAll()
                        .requestMatchers("/register").permitAll()
                        .anyRequest().authenticated());
        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

package com.example.controllers;

import javax.naming.AuthenticationException;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.WebAttributes;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestAttribute;
import org.springframework.web.bind.annotation.RequestMapping;

import com.example.auth.LoginUser;
import com.example.controllers.forms.UserRegisterForm;
import com.example.domains.services.UserRegisterService;

@Controller
public class RootController {

    private final UserRegisterService userRegisterService;

    private final PasswordEncoder passwordEncoder;

    @Autowired
    public RootController(UserRegisterService userRegisterService, PasswordEncoder passwordEncoder) {
        this.userRegisterService = userRegisterService;
        this.passwordEncoder = passwordEncoder;
    }

    @GetMapping("/")
    public String root() {
        return "index";
    }

    @RequestMapping("/login")
    public String login() {
        return "login";
    }

    @PostMapping("/login-error")
    public String onAuthenticationErrorPost(
            @RequestAttribute(WebAttributes.AUTHENTICATION_EXCEPTION) AuthenticationException ex,
            Model model) {
        model.addAttribute("loginError", ex);
        return "login";
    }

    @GetMapping("/register")
    public String signup() {
        return "signup";
    }

    @PostMapping("/register")
    public String register(@ModelAttribute UserRegisterForm form) {
        LoginUser user = new LoginUser();
        user.setEmail(form.getEmail());
        user.setUsername(form.getUsername());
        user.setPassword(passwordEncoder.encode(form.getPassword()));
        userRegisterService.registerUser(user);
        return "redirect:/login";
    }
}

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <link
      href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css"
      rel="stylesheet"
      integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC"
      crossorigin="anonymous"
    />
    <link rel="stylesheet" href="../static/css/styles.css" th:href="@{/css/styles.css}" />
    <title>サインイン</title>
  </head>
  <body>
    <div class="container">
      <div class="row justify-content-center">
        <form method="post" class="col-lg-4 col-md-8 col-sm-8 col-xs-8" action="index.html" th:action="@{/login}">
          <img src="../static/img/logo.png" th:src="@{/img/logo.png}" class="mx-auto d-block my-5" alt="logo.png" />
          <div class="card">
            <div class="card-body">
              <h5 class="card-title text-center login-title">ログイン</h5>
              <hr />
              <div class="form-group mb-3">
                <label for="email" class="form-label">メールアドレス</label>
                <input type="email" class="form-control" id="email" name="email" placeholder="[e-mail]" required />
              </div>
              <div class="form-group mb-3">
                <label for="password" class="form-label">パスワード</label>
                <input type="password" class="form-control" id="password" name="password" required />
              </div>
              <div class="my-1" th:if="${loginError}">
                <span class="text-danger" th:text="${loginError.message}"></span>
              </div>
              <hr />
              <div class="d-flex flex-column">
                <button type="submit" class="btn btn-primary btn-block mb-3">サインイン</button>
                <a th:href="@{/register}" class="btn btn-success btn-block">ユーザー登録</a>
              </div>
            </div>
          </div>
          <input type="hidden" name="_csrf" th:value="${_csrf.token}" />
        </form>
      </div>
    </div>
  </body>
</html>

試したこと

色々調べたり、ChatGPTに質問したが解決できなかったため質問させていただきます。

補足情報（FW/ツールのバージョンなど）

Java17
Spring Boot 3.0.8
Spring Security 6.0

Answer 1

エラーオブジェクトをセッションに保存してセッションスコープから取り出す処理に変更したため、自己解決