apache / apache/grails-core

isFullyAuthenticated() leads to redirect-loop

Open
#15,877 16 comments 6 reactions 0 assignees View on GitHub
relates-to:spring-security type: bug
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

In Grails 3.3.x, isFullyAuthenticated() / IS_FULLY_AUTHENTICATED rule does not work as expected.

When accessing a resource secured by isFullyAuthenticated() using remember-me, a redirect to LoginController.full() is expected, but a redirect loop between login and protected resource happens until the browser gives up.

### Steps to Reproduce
1. Secure a resource in staticRules or interceptUrlMap with IS_AUTHENTICATED_FULLY or isFullyAuthenticated() el expression.
2. Login using remember-me
3. Close browser, and re-access the application to login using remember-me
4. Access the IS_AUTHENTICATED_FULLY secured resource

### Expected Behaviour
Re-login page is shown

### Actual Behaviour
Redirect loop between login and protected resource happens until the browser gives up.
It seems no AuthenticationException is thrown on a remember-me access to a isFullyAuthenticated() resource, therefore LoginController.auth() is called, and not LoginController.full()

### Environment Information
- **Operating System**: OSX 10.14
- **GORM Version:** 6
- **Grails Version (if using Grails):** Tested with 3.3.5 and 3.3.8
- **JDK Version:** 1.8_181 Zulu
- **Plugin version:** 3.2.3

### Example Application
Example simple project showing the problem see https://github.com/robertoschwald/spring-security-core-fully-auth-error

Contributor guide

Open the contributing guide

Research direction

Start with the authentication flow around LoginController.auth() and LoginController.full(), then compare behavior for staticRules or interceptUrlMap using IS_AUTHENTICATED_FULLY or isFullyAuthenticated(). Reproduce the remember-me sequence in the linked example application; done means the protected resource shows the re-login page without entering a redirect loop.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.