Fix Spring Security form-login to use legacy j_username/j_password parameters

[Copilot]

Login authentication was failing after Spring Security 5 migration. The login form uses j_username and j_password (legacy J2EE convention), but Spring Security 5 defaults to username and password.

Changes

• treebase-security.xml / top-security.xml: Added explicit username-parameter and password-parameter attributes to <security:form-login>

<security:form-login
    login-page="/login.jsp"
    login-processing-url="/j_security_check"
    username-parameter="j_username"
    password-parameter="j_password"
    .../>

• DelegatingPasswordEncoderTest.java: Added 12 unit tests covering BCrypt encoding, legacy plain text matching, and password upgrade detection

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• getahead.org
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/xml/tools/xml-extractor.jar --fileList=/home/REDACTED/work/treebase/.codeql-scratch/dbs/java/working/files-to-index14661147682892954639.list --sourceArchiveDir=/home/REDACTED/work/treebase/.codeql-scratch/dbs/java/src --outputDir=/home/REDACTED/work/treebase/.codeql-scratch/dbs/java/trap/java (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

The password authentication system isn't working. I have a user/pass combo. I am able to go through the whole password reset workflow. But then when I try to log in, I can't. You need to do a comprehensive analysis of the initial login procedure:

• how are the user name and password being parsed from the request?
• is the password being encrypted correctly?
• is the encrypted password being checked against the database correctly?
• doe the logic to deal with legacy, unencrypted passwords work and not interfere?

Do a comprehensive analysis before you start patching. Ask questions if you need to. Run tests.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.