SEC-722: Fixed problem with empty loginpage string (rather than null) preventing default login page filter from being added to the stack.

core/src/main/java/org/springframework/security/config/FormLoginBeanDefinitionParser.java

@@ -58,6 +58,9 @@ public class FormLoginBeanDefinitionParser implements BeanDefinitionParser {
             defaultTargetUrl = elt.getAttribute(ATT_FORM_LOGIN_TARGET_URL);
             authenticationFailureUrl = elt.getAttribute(ATT_FORM_LOGIN_AUTHENTICATION_FAILURE_URL);
             loginPage = elt.getAttribute(ATT_LOGIN_PAGE);
+            if (!StringUtils.hasText(loginPage)) {
+            	loginPage = null;
+            }
             source = parserContext.extractSource(elt);
         }
 
@@ -73,7 +76,7 @@ public class FormLoginBeanDefinitionParser implements BeanDefinitionParser {
                 BeanDefinitionBuilder.rootBeanDefinition(AuthenticationProcessingFilterEntryPoint.class);
         entryPointBuilder.setSource(source);
 
-        entryPointBuilder.addPropertyValue("loginFormUrl", StringUtils.hasText(loginPage) ? loginPage : DEF_LOGIN_PAGE);
+        entryPointBuilder.addPropertyValue("loginFormUrl", loginPage != null ? loginPage : DEF_LOGIN_PAGE);
 
         entryPointBean = (RootBeanDefinition) entryPointBuilder.getBeanDefinition();
 

core/src/test/java/org/springframework/security/config/HttpSecurityBeanDefinitionParserTests.java

@@ -122,6 +122,17 @@ public class HttpSecurityBeanDefinitionParserTests {
 
     }
 
+    @Test
+    public void formLoginWithNoLoginPageAddsDefaultLoginPageFilter() {
+        setContext(
+                "    <http auto-config='true' path-type='ant' lowercase-comparisons='false'>" +
+                "        <form-login />" +
+                "    </http>" + AUTH_PROVIDER_XML);
+        FilterChainProxy filterChainProxy = getFilterChainProxy();
+        // These will be matched by the default pattern "/**"
+        checkAutoConfigFilters(filterChainProxy.getFilters("/anything"));
+    }
+    
     @Test
     public void lowerCaseComparisonIsRespectedBySecurityFilterInvocationDefinitionSource() throws Exception {
         setContext(