spring - authentication filter was called repeatedly -

i setup spring security rest apis. here sample of rest call, get: http://localhost:8081/dashboard/epic/data. when executing, filter, provider , eventual onauthenticationsuccess triggered. here problem, instead of executing rest url after authentication, go filter many times. second time, request.getrequesturl http://localhost:8081/dashboard.

here security-context.xml:

  <http auto-config='false' authentication-manager-ref="authenticationmanager" entry-point-ref="authenticationentrypoint">      <intercept-url pattern="dashboard/**" access="role_user" />     <csrf disabled="true"/>     <custom-filter position="remember_me_filter" ref="dashboardfilter"></custom-filter> </http>   <authentication-manager alias="authenticationmanager">     <authentication-provider ref="dashboardauthprovider"></authentication-provider> </authentication-manager>  <beans:bean id="dashboardfilter" class="com.apple.store.dashboard.security.dashboardauthfilter">     <beans:property name="authenticationmanager" ref="authenticationmanager"/>     <beans:property name="authenticationsuccesshandler">         <beans:bean class="com.apple.store.dashboard.security.loginsuccesshandler">           </beans:bean>     </beans:property> </beans:bean>  <beans:bean id="authenticationentrypoint" class="com.apple.store.dashboard.security.dashboardauthentrypoint"> </beans:bean>  <beans:bean id="dashboardauthprovider" class="com.apple.store.dashboard.security.dashboardauthprovider">  </beans:bean> 

here filter

public class dashboardauthfilter extends abstractauthenticationprocessingfilter {     private static final logger logger = loggerfactory.getlogger(dashboardauthfilter.class);      public dashboardauthfilter() {         //super("/j_spring_cas_security_check");         super("/**");     }      public authentication attemptauthentication(final httpservletrequest request, final httpservletresponse response)             throws org.springframework.security.core.authenticationexception, unsupportedencodingexception {         logger.debug("inside dashboardauthfilter:attemptauthentication method:");         authentication auth = securitycontextholder.getcontext().getauthentication();         if (auth!=null ){             if (auth.isauthenticated()){                 logger.debug("previously authenticated.isauthenticated=true::: auth details:" +auth);                 return auth;             }         }          string _username = null;         string _password = null;           string authheader = request.getheader("authorization");         if (authheader != null) {             stringtokenizer st = new stringtokenizer(authheader);             if (st.hasmoretokens()) {                 string basic = st.nexttoken();                  if (basic.equalsignorecase("basic")) {                     try {                         string credentials = new string(base64.decodebase64(st.nexttoken()), "utf-8");                         logger.debug("credentials: " + credentials);                         int p = credentials.indexof(":");                         if (p != -1) {                              _username = credentials.substring(0, p).trim();                              _password = credentials.substring(p + 1).trim();                         }                     } catch (exception e) {                      }                 }             }         }         else             system.out.println("request url "+request.getrequesturl());          authentication authresult = null;         try {             if( org.apache.commons.lang.stringutils.isempty(_password)) {                 throw new preauthenticatedcredentialsnotfoundexception("no username:password..");             }             string credentials = "na";              //string validatecookiedetails = correctauthentication(aoscookie, request);              usernamepasswordauthenticationtoken authrequest = new usernamepasswordauthenticationtoken(_username+":"+_password, credentials);             authresult = getauthenticationmanager().authenticate(authrequest);             logger.debug("attempted authentication: authresult ::" + authresult.tostring());         } catch (org.springframework.security.core.authenticationexception e) {                 logger.error("attemptauthentication: not authenticated : authenticationexception ....." + e.getmessage());          } catch (exception e) {             logger.error("exception occured during authentication....." + e.getmessage());         }         return authresult;     } 

here provider:

public class dashboardauthprovider implements authenticationprovider {      private static final logger logger = loggerfactory.getlogger(dashboardauthprovider.class);       @override     public authentication authenticate(final authentication authentication) throws authenticationexception {         logger.debug("inside dashboardauthprovider: authenticate method +authentication=" + authentication);         authentication auth =null;         final list<grantedauthority> grantedauths = new arraylist<>();         grantedauths.add(new simplegrantedauthority("role_user"));         try{             string[] principalstrarr = ((string)authentication.getprincipal()).split(":");             //convert authentication principal object map              if (principalstrarr[0].equals("test1") && principalstrarr[1].equals("test1"))             {                 string username = principalstrarr[0];                 string password = principalstrarr[1];                   final userdetails principal = new accessinfo(username, password, grantedauths);                 auth = new usernamepasswordauthenticationtoken(principal, password, grantedauths);                  logger.info("dashboardauthprovider auth= " + auth);             }             else {                 logger.info("wrong credential");                 return null;             }         }catch (exception e){             logger.error(                     "exception occured in dashboardauthprovider during authentication",                     e);         }         return auth;      } 

and here onauthenticationsuccess:

public class loginsuccesshandler extends simpleurlauthenticationsuccesshandler implements authenticationsuccesshandler {      @override     public void onauthenticationsuccess(httpservletrequest request, httpservletresponse response, authentication authentication) throws ioexception, servletexception {              super.onauthenticationsuccess(request, response, authentication);      }