jdaugherty opened a new pull request, #16743:
URL: https://github.com/apache/grails-core/pull/16743
## Description
Fixes #16739
Spring Security 7 removed `FilterSecurityInterceptor`, and the replacement
in `grails-spring-security-compat` authorized every dispatch of a request. The
plugin still wires `fii.observeOncePerRequest` (default `true`) into the bean,
but the compat `doFilter` never read it, so the `ERROR` dispatch that renders
an error page was authorized against the error page's own rule. An application
whose rules do not permit `/error` then answered every container error page
sent to an unauthenticated caller with a redirect to the login page, where
Grails 7.x served the page.
The interceptor now marks the request with the attribute Spring Security 6
used, before authorizing it, and passes later dispatches of a marked request
through when `observeOncePerRequest` is set. Marking before the authorization
lets the error page of a denied request through as well.
### Tests
- `FilterSecurityInterceptorSpec` (plugin) gains four features: a second
dispatch of an authorized request, of a public request and of a denied request,
and the flag turned off. The first three fail without the fix.
- The core functional-test-app gains an `oncePerRequest` `TESTCONFIG` with
no rule for `/error`, a public `SendErrorController.notFound` action, and
`OncePerRequestSpec`: the 404 page of a public action and the 403 page of a
denied request are served, while a direct request to `/error` and a secured URL
are still authorized on their first dispatch. Both error-page features fail
without the fix. The configuration leaves `adh.errorPage` unset on purpose:
with the default denied page, an `ERROR` dispatch that is denied again is
forwarded to `/login/denied` and Grails still renders the 403 view for the
error status, which hides the regression in the 403 case.
- The new configuration is added to the `securityConfig` matrix.
`OncePerRequestSpec` and `NoAnonymousFilterSpec` share
`AbstractHttpClientSecuritySpec` for the user seeding, the Basic Auth
credentials and the client that does not follow redirects.
### Documentation
The guide's description of `fii.observeOncePerRequest` and its
configuration-metadata description now name the `ERROR` dispatch, and the guide
says the skip covers every dispatcher type the chain is registered for,
`REQUEST` and `ERROR` by default.
### Verification
Run locally: `FilterSecurityInterceptorSpec`, the compat module's test
suite, `OncePerRequestSpec` under `-DTESTCONFIG=oncePerRequest`,
`NoAnonymousFilterSpec` under `-DTESTCONFIG=noAnonymous`,
`:grails-spring-security-compat:codeStyle` and `validateRepositoryConventions`.
The plugin's full suite and the other `TESTCONFIG` runs are left to CI.
## Contributor Checklist
### Issue and Scope
- [x] This PR is linked to an existing issue that has been **acknowledged or
approved** by the project team. If no approved issue exists, please give
background on why this change is necessary. Tickets are preferred for release
change log history.
- [x] This PR addresses the **complete scope** of the linked issue. Partial
implementations or unfinished work should not be submitted for review.
- [x] This PR contains a **single, focused change**. Unrelated changes
should be submitted as separate pull requests.
- [x] This PR targets the **correct branch** for the type of change:
- **Patch release branches** (e.g., `7.0.x`): Bug fixes only. No new
features or API changes.
- **Minor release branches** (e.g., `7.1.x`): New features are welcome,
but breaking existing APIs must be avoided.
- **Major release branches** (e.g., `8.0.x`): Reserved for major
changes. Breaking API changes are permitted.
### Code Quality
- [x] I have **added or updated tests** that cover the changes introduced in
this PR. All code contributions are expected to include appropriate test
coverage.
- [ ] I have verified that all existing tests pass by running `./gradlew
build --rerun-tasks`.
- [x] My code follows the project's **code style** guidelines. I have run
`./gradlew codeStyle` and resolved any violations. See [Code
Style](../CONTRIBUTING.md#code-style) for details.
- [x] This PR does **not** include mass reformatting, style-only changes, or
large-scale refactoring unless it was **explicitly approved** in the linked
issue. Unsolicited reformatting will not be accepted.
- [ ] If generative AI tooling was used in preparing this contribution, a
quality model was used to ensure contributions are **consistent with the
project's quality standards**.
### Licensing and Attribution
- [x] All contributed code is provided under the [Apache License
2.0](https://www.apache.org/licenses/LICENSE-2.0), and new source files include
the appropriate **Apache license header**.
- [ ] I have the necessary rights to submit this contribution and confirm it
is my own original work (see [Legal
Notice](../CONTRIBUTING.md#i-want-to-contribute)).
- [ ] If generative AI tooling was used in preparing this contribution, I
have followed the [Apache Software Foundation's policy on generative
tooling](https://www.apache.org/legal/generative-tooling.html) and have
properly attributed its use.
### Documentation
- [x] If this PR introduces user-facing changes, I have included or updated
the relevant documentation.
- [ ] If this PR adds a new feature, I have updated the **What's New**
section of the Grails Guide.
- [ ] If this PR introduces breaking changes or changes that require user
action during an upgrade, I have updated the **Upgrade Notes** for the
corresponding version in the Grails Guide.
- [x] The PR description clearly explains **what** was changed and **why**.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
