Grails Spring Security redirect to login page using https

user_114181 0
Viewed 5475

I have a Grails app using Spring Security Core running on an AWS machine behind a load balancer.

The load balancer decrypts the ssl connections and forwards to port 8080 of our instance adding appropriate X-Forwarded-Proto headers.

I would like any direct access to a secured page to redirect to the login page using https.

For example a request https://myapp.com/private/page should redirect to https://myapp.com/login/auth

I put this in my config.groovy:

grails.plugin.springsecurity.secureChannel.definition = [
    '/login/**':        'REQUIRES_SECURE_CHANNEL'
]

but this causes a redirect loop (HTTP code 302) to the http login page (http://myapp.com/login/auth)

Then I tried just with:

grails.plugin.springsecurity.secureChannel.useHeaderCheckChannelSecurity = true
grails.plugin.springsecurity.auth.forceHttps = true

but this causes a redirect (HTTP code 302) to the http login page (http://myapp.com/login/auth)

  1. The issue is presentig just with the production setup (war deployed to Tomcat behind the load balancer).
  2. If I test the same config.groovy on my loacal dev machine the redirect to https://myapp.com/login/auth happens just fine.
  3. I tried to specify a different httpsPort for spring security, again it works on my local dev machine but it is completely ignored in the deployed app that keeps redirecting to http

No luck lurking at similar posts, any idea?

spring-security https redirect grails authentication
3 Answers

I faced similar issue in similar environment where the front end was on https and behind the firewall grails server was on http. When session was timed out, ajax and angular $http used to get a redirect message to http://myclient.com/myWar/login/auth. This redirect request used to cause access denied in browser because original url was https and mixed content was disabled. I used to get SCRIPT7002: XMLHttpRequest: Network Error 0x80700013, Could not complete the operation due to error 80700013.” This error occurred only in production and not in test environment.

Fix is simple, simply add the following to the configuration file. grails.serverURL = "https://mywebsitespublicaddress.com/myWar"

user_46935130
Related