The GitHub Actions job "CI" on grails-core.git/feat/default-security-headers has failed. Run started by GitHub user borinquenkid (triggered by borinquenkid).
Head commit for run: 80c3304fd5ce0b424bebcdff340d5e119a60a2aa / Walter Duque de Estrada <[email protected]> Back off when Spring Security is present; document reverse-proxy/HSTS gaps Addresses jdaugherty's 3 unresolved review findings, all confirmed against the current code before fixing: - Spring Security precedence (verified inverted doc claim): this filter registers at GrailsFilters.LAST (order -110), before Spring Security's chain (-100), and applied its defaults eagerly - so Spring Security's header writers (which skip a header that's already present) never got a chance to win, contrary to what the upgrade notes claimed. Fixed by adding @ConditionalOnMissingClass("...HeaderWriterFilter") to GrailsSecurityHeadersAutoConfiguration so the whole auto-configuration backs off when Spring Security's header-writing infrastructure is on the classpath, per jdaugherty's suggested option - Spring Security already ships its own configurable header defaults. Added a spring-security-web test-only dependency and a FilteredClassLoader-based helper so the existing "Spring Security absent" tests keep exercising that path explicitly, plus a new test confirming the back-off. - HSTS silently never sent behind a TLS-terminating reverse proxy (request.isSecure() is false unless server.forward-headers-strategy is configured): this isn't a code bug - request.isSecure() is the correct check, and Spring Boot's forward-headers-strategy is the standard way to make it proxy-aware - so documented the proxy case and the mitigation in the security guide instead of changing behavior. - Reverse-proxy header duplication (nginx add_header appends rather than replaces, so the client can receive a header twice once the app also sends it): also not something a code change here can generally detect or fix, since the proxy operates entirely outside the request pipeline. Documented the risk (with the concrete Chrome/CSP/ Referrer-Policy duplicate-header failure modes jdaugherty identified) and the mitigation (disable the affected header(s) at the app and let the proxy own them, or strip the app's copy at the proxy). Co-Authored-By: Claude Sonnet 5 <[email protected]> Report URL: https://github.com/apache/grails-core/actions/runs/30298326124 With regards, GitHub Actions via GitBox
