Grail protection with grails filter

Question

I have an application in which I use spring security along with the grails melody. I plan to launch Grails in a production environment, but I don’t want visitors to have access to it. How do I achieve this? I tried creating a filter in grails (just showing a sample of what I'm trying, not the actual code) -

def filters = { allURIs(uri:'/**') { before = { //... if(request.forwardURI.indexOf("admin") != -1 || request.forwardURI.indexOf("monitoring") != -1) { response.sendError 404 return false } } } } 

But this does not work, since the request for "monitoring" does not fall into this filter. I don’t even want the user to know that such a URL exists, so I want to check the filter, if "monitoring" is a URL, I display a 404 error page. This is also the reason why I do not want to protect this URL using spring security as it will show the access access page.

Basically, I want URLs to exist, but they should be invisible to users. I want to allow access only to specific IP addresses for these special URLs.

In another note: Is it possible to write a grails filter that "acts" before hitting the spring security filter? I want to be able to do some filtering before I forward requests to spring security. Writing a grails filter as above does not help. spring security filter comes first if I access a protected resource and this filter is not called.

thanks

Answer 1

Grails filters are wrappers around Spring hooks, so they run "real" servlet filters, such as those used by Spring Security. If you want something to work before Spring Security, you need to register the filter in web.xml or possibly in the plugin filter chain.

This is one of the motivations of the IP address filter. We need an administrator section, accessible for registered administrators, but also available only when accessing a local network or VPN. LAN and VPN IP addresses all started with 10. So we added a rule for

 '/admin/**': '10.**' 

The filter sends a 404 response to hide the existence of resources.

See http://burtbeckwith.github.com/grails-spring-security-core/docs/manual/guide/10.%20Extending%20and%20configuring%20the%20plugin.html#10.8.%20IP%20Address%20Restrictions for documentation on this.

Answer 2

I looked at Grails Ringtone protection (e.g. / monitoring) using Spring Security. I did this now using Apache HTTP Basic authentication (we use apache for proxies for tomcat), but this is not ideal as I am looking to deploy an application in CloudFoundry.

Perhaps this can be done, for example, using the Grails WebXmlConfig plugin? I see that Burt contributed - at least to the documentation page? I'm not sure if the plugin is actually not documented ...

Answer 3

Burt's answer is good.

Another answer might be to use javamelody included in the security settings: http://code.google.com/p/javamelody/wiki/UserGuide#15._Security

For example, you can add the following parameter, which is a regular expression in the GrailsMelodyConfig.groovy file: javamelody.'allowed-addr-pattern '=' 127.0.0.1 '

Answer 4

Here is what I did in a similar scenario (JavaMelody 1.29.0 and Spring Security 3.0.5). I wanted to restrict the access to Melody reports to admin users.

Spring Security Configuration:

 <http auto-config="true" use-expressions="true"> ... <intercept-url pattern="/monitoring/**" access="hasRole('ROLE_ADMIN')" /> ... </http> 

web.xml config:

 <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <filter> <filter-name>monitoring</filter-name> <filter-class>net.bull.javamelody.MonitoringFilter</filter-class> </filter> <filter-mapping> <filter-name>monitoring</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> 

The key is to make sure that the monitoring filter is defined after the Spring filter chain.