Infinite loop on http -> https redirect (spring security)

[dnenciu]

Hello I have setup my app to use spring security.

I also setup secure channel for the login.

If I use the https link to login https://myserver/myapp/ it works fine but
if I try to use http://myserver/myapp/ it goes in an infinite loop.

The same behaviour happens on all links after.

On debug I see that it keeps on redirecting in a loop:

DEBUG web.FilterChainProxy - Converted URL to lowercase, from: '/'; to: '/'
2011-02-19 19:59:18,140 [http-9090-1] DEBUG web.FilterChainProxy -
Candidate is: '/'; pattern is /**; matched=true
2011-02-19 19:59:18,140 [http-9090-1] DEBUG web.FilterChainProxy - / at
position 1 of 9 in additional filter chain; firing Filter:
'ChannelProcessingFilter'
2011-02-19 19:59:18,140 [http-9090-1] DEBUG
intercept.DefaultFilterInvocationSecurityMetadataSource - Converted URL to
lowercase, from: '/'; to: '/'
2011-02-19 19:59:18,140 [http-9090-1] DEBUG
intercept.DefaultFilterInvocationSecurityMetadataSource - Candidate is:
'/'; pattern is /images/**; matched=false
2011-02-19 19:59:18,140 [http-9090-1] DEBUG
intercept.DefaultFilterInvocationSecurityMetadataSource - Candidate is:
'/'; pattern is /css/**; matched=false
2011-02-19 19:59:18,140 [http-9090-1] DEBUG
intercept.DefaultFilterInvocationSecurityMetadataSource - Candidate is:
'/'; pattern is /js/**; matched=false
2011-02-19 19:59:18,140 [http-9090-1] DEBUG
intercept.DefaultFilterInvocationSecurityMetadataSource - Candidate is:
'/'; pattern is /**; matched=true
2011-02-19 19:59:18,140 [http-9090-1] DEBUG channel.ChannelProcessingFilter
- Request: FilterInvocation: URL: /; ConfigAttributes:
[REQUIRES_SECURE_CHANNEL]
2011-02-19 19:59:18,140 [http-9090-1] DEBUG channel.RetryWithHttpsEntryPoint
- Redirecting to: /WebMining/
2011-02-19 19:59:18,140 [http-9090-1] DEBUG mvc.GrailsWebRequestFilter -
Cleared Grails thread-bound request context:
***@77af4e9d
2011-02-19 19:59:18,142 [http-9090-1] DEBUG
spring.ReloadAwareAutowireCapableBeanFactory - Returning cached instance of
singleton bean 'groovyPagesTemplateEngine'
2011-02-19 19:59:18,142 [http-9090-1] DEBUG
support.DefaultListableBeanFactory - Returning cached instance of singleton
bean 'pluginManager'
2011-02-19 19:59:18,142 [http-9090-1] DEBUG
support.DefaultListableBeanFactory - Returning cached instance of singleton
bean 'grailsApplication'
2011-02-19 19:59:18,142 [http-9090-1] DEBUG
spring.ReloadAwareAutowireCapableBeanFactory - Returning cached instance of
singleton bean 'groovyPagesUriService'
2011-02-19 19:59:18,142 [http-9090-1] DEBUG
spring.ReloadAwareAutowireCapableBeanFactory - Returning cached instance of
singleton bean 'messageSource'
2011-02-19 19:59:18,142 [http-9090-1] DEBUG mvc.GrailsWebRequestFilter -
Bound Grails request context to thread:
***@77af4e9d
2011-02-19 19:59:18,142 [http-9090-1] DEBUG filter.GrailsReloadServletFilter
- Executing Grails reload filter...
2011-02-19 19:59:18,142 [http-9090-1] DEBUG
support.DefaultListableBeanFactory - Returning cached instance of singleton
bean 'grailsApplication'
2011-02-19 19:59:18,142 [http-9090-1] DEBUG web.FilterChainProxy -
Converted URL to lowercase, from: '/'; to: '/'
2011-02-19 19:59:18,142 [http-9090-1] DEBUG web.FilterChainProxy -
Candidate is: '/'; pattern is /**; matched=true
2011-02-19 19:59:18,142 [http-9090-1] DEBUG web.FilterChainProxy - / at
position 1 of 9 in additional filter chain; firing Filter:
'ChannelProcessingFilter'

Here is my config:
grails.plugins.springsecurity.interceptUrlMap = [
'/login/**': ['IS_AUTHENTICATED_ANONYMOUSLY'],
'/**': ['ROLE_ADMIN', 'IS_AUTHENTICATED_FULLY']
]

grails.plugins.springsecurity.secureChannel.definition = [
'/images/**': 'ANY_CHANNEL',
'/css/**': 'ANY_CHANNEL',
'/js/**': 'ANY_CHANNEL',
'/**': 'REQUIRES_SECURE_CHANNEL'
]

Dragos

[dnenciu]

I saw an article about doing http to https switching but it means a second
set of config files that need to be maintained separately. Is there any
other cleaner solutions?

At least for the login page (the root of the domain "/"). The rest I can
live without, but I can't force people to type https just to get to my site.

Here is the link to the article on http->https switching:
http://www.juliesoft.com/2010/04/automatic-httphttps-switching-with-grails/

Thanks,
Dragos

[dnenciu]

So nobody has ever dealt with this issue?

[Daniel Henrique Alves Lima]

Hi, Dragos. Do you have a sample app demonstrating the issue?

Best regards,
Daniel.

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

http://xircles.codehaus.org/manage_email

[dnenciu]

Ok I found the issue. :)

The clue came when I switched back to default ports (80, 443) and it worked.

I forgot to set the spring security ports:
portMapper.httpPort 8080 HTTP port your application uses.
portMapper.httpsPort 8443 HTTPS port your application uses.

in the config to the non default values I had and that was causing the
redirect loop.

Thanks,
Dragos.