sbglasius commented on code in PR #16174:
URL: https://github.com/apache/grails-core/pull/16174#discussion_r3819486894
##########
grails-spring-security/cas/plugin/src/main/groovy/grails/plugin/springsecurity/cas/SpringSecurityCasGrailsPlugin.groovy:
##########
@@ -87,10 +91,30 @@ class SpringSecurityCasGrailsPlugin extends Plugin {
if (conf.cas.useSingleSignout) {
- // session fixation prevention breaks single signout because
- // the service ticket is mapped to the session id which changes
+ // Session fixation prevention breaks single signout because
the service ticket is
+ // mapped to the session id, which changes when the session is
replaced on login.
+ // Disabling it is a security trade-off the application has
opted into, so say so.
+ String message = '''
+ WARNING: cas.useSingleSignout is enabled, so session fixation prevention
has been disabled.
+ CAS maps the service ticket to the HTTP session id, and a logout request
cannot be matched to a
+ session that was replaced when the user authenticated. Set
cas.useSingleSignout to false to keep
+ session fixation prevention and handle logout in the application instead.
+ '''
+ println message
Review Comment:
Since Grails Spring Security uses `println` I have removed `log.warn`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
