defect
If a login attempt fails (no valid session detected), the TopLogicServlet currently redirects to the configured LoginPage. However, this is undesirable because it can potentially cause a loop if the problematic request originated from that very page.
Instead, it should redirect to the configured LogoutPage, which should typically also include a link for “logging in again.”
This hasn’t been noticed so far because, in most cases, the same page—"login.jsp"—is configured for both the LoginPage and the LogoutPage.
However, if the LoginPage and LogoutPage differ in a given installation, the current behavior is simply incorrect.
Test
No test.