UrlEncodedSlash blocked by HttpFirewall (Grails 3.3.0.RC1; Spring-security-core 3.2.0.M1)
I find these errors in my logs:
org.springframework.security.web.firewall.RequestRejectedException: The requestURI cannot contain encoded slash. Got /;lm=1488887514;m=js;asset=delayedElements%2Fsnippet;tf;ucm=353df4434086482d9d1d7b89758e156e/
at org.springframework.security.web.firewall.DefaultHttpFirewall.getFirewalledRequest(DefaultHttpFirewall.java:56)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.grails.web.servlet.mvc.GrailsWebRequestFilter.doFilterInternal(GrailsWebRequestFilter.java:77)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
...
And I found this solution which probably works in Spring Boot. Spring security DefaultHttpFirewall - RequestURI cannot contain encoded forward slash
Can I and how can I apply this in Grails? Thank you very much in advance!
EDIT 1:
This is how I applied Sudhir's suggestion:
Here I created a new class:
This is what the implementation looks like:
package fnx.security;
import org.springframework.security.web.firewall.DefaultHttpFirewall;
public class CustomHttpFirewall extends DefaultHttpFirewall {
CustomHttpFirewall() {
boolean allowUrlEncodedSlash = true;
}
}
And this is how it is included in application.yml:
grails:
plugin:
springsecurity:
httpFirewallBeanClass: 'fnx.security.CustomHttpFirewall'
Is there anything missing or wrong?
source to share
By default spring security core plugin uses DefaultHttpFirewall
, you can subclass by extending DefaultHttpFirewall
and set property allowUrlEncodedSlash
to true from constructor.
CustomHttpFirewall extends DefaultHttpFirewall {
CustomHttpFirewall() {
allowUrlEncodedSlash = true
}
}
And then configure spring security to use your custom firewall class as shown below.
grails.plugin.springsecurity.httpFirewallBeanClass = "full name of your class"
Note checked, but this should work.
source to share