What does mask spring authentication nginx configuration do?

Question

I have the following setting in my nginx.conf but I am not sure what it does. I copied it from a Google search.

   location / {
        set $tempRequest $request;
        if ($tempRequest ~ (.*)j_password=[^&]*(.*)) {
            # Mask spring authentication password param.
            set $tempRequest $1j_password=****$2;
        }

Can someone explain what it does? I am using nginx as a proxy server for a grails application running on Tomcat.

I thought this setting would not show j_password parameter when users submit the password at authentication time but I can see the value of j_password using Chrome Inspect when the form is submitted.

Answer 1

I don't know what it exactly does, but I assume you want to rename the parameters. The parameters have to be POSTed anyway, so there's no way around that, but if you want to rename to something else, you the following (in resources.xml):

<beans:bean class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
                 <beans:property name="usernameParameter" value="user_name">
        <beans:property name="passwordParameter" value="passwd">
        < !-- other properties which you also use in the -login element -->
</beans:bean>