The GitHub Actions job "CI" on grails-core.git/feat/default-security-headers 
has failed.
Run started by GitHub user borinquenkid (triggered by borinquenkid).

Head commit for run:
80c3304fd5ce0b424bebcdff340d5e119a60a2aa / Walter Duque de Estrada 
<[email protected]>
Back off when Spring Security is present; document reverse-proxy/HSTS gaps

Addresses jdaugherty's 3 unresolved review findings, all confirmed
against the current code before fixing:

- Spring Security precedence (verified inverted doc claim): this filter
  registers at GrailsFilters.LAST (order -110), before Spring Security's
  chain (-100), and applied its defaults eagerly - so Spring Security's
  header writers (which skip a header that's already present) never got
  a chance to win, contrary to what the upgrade notes claimed. Fixed by
  adding @ConditionalOnMissingClass("...HeaderWriterFilter") to
  GrailsSecurityHeadersAutoConfiguration so the whole auto-configuration
  backs off when Spring Security's header-writing infrastructure is on
  the classpath, per jdaugherty's suggested option - Spring Security
  already ships its own configurable header defaults. Added a
  spring-security-web test-only dependency and a
  FilteredClassLoader-based helper so the existing "Spring Security
  absent" tests keep exercising that path explicitly, plus a new test
  confirming the back-off.
- HSTS silently never sent behind a TLS-terminating reverse proxy
  (request.isSecure() is false unless server.forward-headers-strategy
  is configured): this isn't a code bug - request.isSecure() is the
  correct check, and Spring Boot's forward-headers-strategy is the
  standard way to make it proxy-aware - so documented the proxy case
  and the mitigation in the security guide instead of changing behavior.
- Reverse-proxy header duplication (nginx add_header appends rather than
  replaces, so the client can receive a header twice once the app also
  sends it): also not something a code change here can generally detect
  or fix, since the proxy operates entirely outside the request
  pipeline. Documented the risk (with the concrete Chrome/CSP/
  Referrer-Policy duplicate-header failure modes jdaugherty identified)
  and the mitigation (disable the affected header(s) at the app and let
  the proxy own them, or strip the app's copy at the proxy).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

Report URL: https://github.com/apache/grails-core/actions/runs/30298326124

With regards,
GitHub Actions via GitBox

Reply via email to