isFullyAuthenticated() leads to redirect-loop
- Dominant language
- Groovy
- Stars
- 2.9k
- Forks
- 975
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 92
Description
In Grails 3.3.x, isFullyAuthenticated() / IS_FULLY_AUTHENTICATED rule does not work as expected.
When accessing a resource secured by isFullyAuthenticated() using remember-me, a redirect to LoginController.full() is expected, but a redirect loop between login and protected resource happens until the browser gives up.
### Steps to Reproduce
1. Secure a resource in staticRules or interceptUrlMap with IS_AUTHENTICATED_FULLY or isFullyAuthenticated() el expression.
2. Login using remember-me
3. Close browser, and re-access the application to login using remember-me
4. Access the IS_AUTHENTICATED_FULLY secured resource
### Expected Behaviour
Re-login page is shown
### Actual Behaviour
Redirect loop between login and protected resource happens until the browser gives up.
It seems no AuthenticationException is thrown on a remember-me access to a isFullyAuthenticated() resource, therefore LoginController.auth() is called, and not LoginController.full()
### Environment Information
- **Operating System**: OSX 10.14
- **GORM Version:** 6
- **Grails Version (if using Grails):** Tested with 3.3.5 and 3.3.8
- **JDK Version:** 1.8_181 Zulu
- **Plugin version:** 3.2.3
### Example Application
Example simple project showing the problem see https://github.com/robertoschwald/spring-security-core-fully-auth-error
Contributor guide
Research direction
Start with the authentication flow around LoginController.auth() and LoginController.full(), then compare behavior for staticRules or interceptUrlMap using IS_AUTHENTICATED_FULLY or isFullyAuthenticated(). Reproduce the remember-me sequence in the linked example application; done means the protected resource shows the re-login page without entering a redirect loop.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- groovy
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100