Grails spring - static security rules for a rest resource don't seem to work properly

Question

I have a Grails application (2.0.4) using the Spring Security Plugin (version 1.2.7.3) and a secure annotation approach (by default here ).

Now I have these URLs in UrlMapping.groovy with a resource key or a pair of controller / action, for example:

"/$controller/$action?/$id?" { constraints { // apply constraints here } } // other rules, all working properly "/api/item/$id?"(resource: 'itemRest') '/api/item/batch-delete'(controller: 'itemRest', action: 'batchDelete') 

RESTful mapping works fine with ItemRestController: each method (show, update, save, delete) correctly maps to the corresponding HTTP method. And an extra method (batchDelete) also works.

I got the API URL by doing the following:

 grails.plugins.springsecurity.controllerAnnotations.staticRules = [ // ... '/something/**': ['IS_AUTHENTICATED_FULLY'] '/api/**': ['IS_AUTHENTICATED_FULLY'] ] 

Now I am redirected to the login page if I call:

 http://host/context/something/bla_bla 

But if I do not call (with the appropriate payload, when necessary):

 http://host/context/api/item/batchDelete http://host/context/api/item/1 http://host/context/api/item 

My suspect is that static rules do not work properly when matching the rest of the controller with the resource key.

Also note that in the UrlMapping.groovy file, the URL for something is missing.

Any ideas?

Answer 1

I think you should use

 grails.plugins.springsecurity.controllerAnnotations.staticRules = [ '/itemrest/**': ['IS_AUTHENTICATED_FULLY'], //this will be redundant after the above rule I guess '/api/**': ['IS_AUTHENTICATED_FULLY'] ] 

URLs that do not display in urlMapping must reference the controller directly in the rules. See the warning under controllerAnnotations.staticRules in the docs.

When mapping URLs for controllers that display in UrlMappings.groovy, you need to protect URLs that do not contain URLs. For example, if you have a FooBarController that you are / foo / bar / $, you should register this in controllerAnnotations.staticRules as / foobar / **. This is different than the mapping that you would use for the other two approaches, and is necessary because the annotations.staticRules controller entries are processed as if they were annotations on the corresponding controller.