apache / apache/grails-core

Grails 7 - grails-spring-security Doc - default approch

Open
#15,849 1 comment 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Expected Behavior

grails-spring-security is using pessimistic approach **by default** as it says in section `4.1. Pessimistic Lockdown`. Which is true I have tested it.

### Actual Behaviour

But grails-spring-security Doc section 1.1.3, presumes Public approach **by default**. Methods in Controller should be lockdown by `@Secured(['ROLE_USER'])`

### Steps To Reproduce

See section 1.1.3 and 4.1 of [Spring Security Core Plugin - Reference Documentation](https://apache.github.io/grails-spring-security/7.0.x/core-plugin/guide/index.html#gettingStarted)

### Environment Information

java=21.0.8-zulu
gradle=8.14.3
groovy=4.0.28
grails=7.0.0-RC2

### Example Application

_No response_

### Version

7

Contributor guide

Open the contributing guide

Research direction

Start with sections 1.1.3 and 4.1 of the linked Spring Security Core Plugin Reference Documentation and compare their statements about the default approach. Reconcile the documentation so it consistently describes the actual default behavior, then verify both sections no longer contradict each other.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy, spring
Domain
documentation, security
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.