AuthenticationFailureBadCredentialsEvent published twice

Summary

AuthenticationFailureBadCredentialsEvent gets published twice with due the fix of #6009, WebSecurityConfigurerAdapter.java:203.

Actual Behavior

If you create a ApplicationListener<AuthenticationFailureBadCredentialsEvent> and listen to AuthenticationFailureBadCredentialsEvent, you get notified twice when the users provides wrong credentials.

Expected Behavior

Same as AuthenticationSuccessEvent, the AuthenticationFailureBadCredentialsEvent should get published only once.

Configuration

Can be reproduced if you use spring-boot-samples/spring-boot-sample-web-secure-custom and add an ApplicationListener<AuthenticationFailureBadCredentialsEvent>.

Version

Spring Security 5.1.2.RELEASE

Sample

Take spring-boot-samples/spring-boot-sample-web-secure-custom and add an ApplicationListener<AuthenticationFailureBadCredentialsEvent>.

@Component
protected static class LoginAttemptAuthenticationFailureEventListener implements ApplicationListener<AuthenticationFailureBadCredentialsEvent> {
	@Override
	public void onApplicationEvent(AuthenticationFailureBadCredentialsEvent event) {
		System.out.println(event.toString());
	}
}

spring-boot-sample-web-secure-custom.zip

[martinwithaar]

I changed my springBootVersion from '2.1.1.RELEASE' to '2.1.2.RELEASE' and can confirm it solved my issue.

[jgrandja]

@mptardy

if this is a bug, would it be possible to fix i in a 5.1.x update?

Yes, it will be back patched to 5.1.x and 5.0.x