I have the following setting in my nginx.conf but I am not sure what it does. I copied it from a Google search.

   location / {
        set $tempRequest $request;
        if ($tempRequest ~ (.*)j_password=[^&]*(.*)) {
            # Mask spring authentication password param.
            set $tempRequest $1j_password=****$2;

Can someone explain what it does? I am using nginx as a proxy server for a grails application running on Tomcat.

I thought this setting would not show j_password parameter when users submit the password at authentication time but I can see the value of j_password using Chrome Inspect when the form is submitted.

1 Answer 1


I don't know what it exactly does, but I assume you want to rename the parameters. The parameters have to be POSTed anyway, so there's no way around that, but if you want to rename to something else, you the following (in resources.xml):

<beans:bean class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
                 <beans:property name="usernameParameter" value="user_name">
        <beans:property name="passwordParameter" value="passwd">
        < !-- other properties which you also use in the -login element -->

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.