Spring Security Core authAjax how to ignore referer

Question

I am using Grails 1.3.7 and the latest spring-security-core plugin. The following method has been implemented in my LoginController:

def authAjax = { response.setHeader 'Location', SpringSecurityUtils.securityConfig.auth.ajaxLoginFormUrl response.sendError HttpServletResponse.SC_UNAUTHORIZED } 

And in my global JavaScript file, I have the following:

 $.ajaxSetup({ error: function(xhr, status, err) { if (xhr.status == 401) { // display a login form in a dialog } } }); 

The login form is a standard login form directly from the plugin documentation. The only difference is that I submit my form using jQuery as follows:

 var params = $('#ajaxLoginForm').serialize(); $.post($('#ajaxLoginForm').attr('action'), params, function(jsonData) { if (jsonData.success) { $('#login-dialog').dialog('close'); } else { alert('TODO: display errors'); } }, 'json'); 

The problem is that the first time I click on the login button, I seem to authenticate normally, but the response returned from the server is a 302 redirect based on the Referer request header. Thus, the body of my $ .post () never starts. I get HTML instead of JSON. In fact, this does not affect my LoginController.ajaxSuccess method until the second view. I read and re-read the documentation, and something is missing.

UPDATE: It looks like this might not be the Referer problem, since the second time the form is submitted, the Referer still exists. Therefore, I completely lose why I have to submit the form twice for the ajaxSuccess method to call.

Answer 1

When you try to access a protected resource an unauthorized attempt, Spring Security saves this request in your session (http://static.springsource.org/spring-security/site/apidocs/org/springframework/security/web/savedrequest/DefaultSavedRequest.html ), and then upon successful authentication, it redirects you to this request. You can probably disable this behavior in all directions with the Spring Security Configuration, but this is probably not what you want for most workflows. You can also explicitly remove SavedRequest from the session in your authAjax method, but again, this is probably not the best experience for the user.

I believe that LoginController.ajaxSuccess is included only if SavedRequest is not redirected to insted, so the HTML received should be the result of your initial request, which was not authorized at that time. So, the trick is that you want to use any function that you would use to process the original request as a success method in the #ajaxLoginForm view.

Answer 2

Gregg, you probably beat the default container behavior for 401 responses. I recommend you use something like:

 def authAjax = { response.setHeader 'Location', SpringSecurityUtils.securityConfig.auth.ajaxLoginFormUrl render status: 401, contentType: "application/json", { message = "You are not authorized for this page" } } 

I have not tested it, so let me know how this happens.