apache / apache/grails-core

Grails 7 - grails-spring-security Doc - Static Request Map

Open
#15,848 2 comments 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Expected Behavior

I am following doc https://apache.github.io/grails-spring-security/7.0.x/core-plugin/guide/index.html section 4.5. Static Map. If i **don't add** securityConfigType line, everything works fine as expected.
`grails.plugin.springsecurity.securityConfigType = "InterceptUrlMap"`
then I add static rules
`grails.plugin.springsecurity.controllerAnnotations.staticRules = [ ... ]
grails.plugin.springsecurity.filterChain.chainMap = [ ... ]`
But if i **add** this securityConfigType line (as document says i should) i get _not authorized_ error.

### Actual Behaviour

when i add the line securityConfigType, i get not authorized. For example index page is permitAll but still I get _not authorized_.
`[pattern: '/assets/**', access: ['permitAll']],
[pattern: '/index', access: ['permitAll']],
[pattern: '/index.gsp', access: ['permitAll']],`
Confusing part is, /assets/ are permitted. This works http://localhost:8083/example3/assets/grails.svg but this is not authorized http://localhost:8083/example3/

### Steps To Reproduce

See my [Example3 config](https://github.com/arjangch/grails-project-helper/blob/main/example3/grails-app/conf/application.groovy)
Am i configuring this wrong?

### Environment Information

java=21.0.8-zulu
gradle=8.14.3
groovy=4.0.28
grails=7.0.0-RC2

### Example Application

https://github.com/arjangch/grails-project-helper/blob/main/example3

### Version

7.0.0-RC2

Contributor guide

Open the contributing guide

Research direction

Reproduce the problem with the example3 application and inspect its grails-app/conf/application.groovy configuration alongside section 4.5, “Static Map,” of the Grails Spring Security 7.0.x guide. Compare behavior with and without securityConfigType set, focusing on why /assets/** is permitted while /index is rejected. Done means the example and documentation agree on the correct configuration and the index request is handled as documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy, spring
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.