matrei commented on code in PR #16375:
URL: https://github.com/apache/grails-core/pull/16375#discussion_r4073805880
##########
grails-test-examples/scaffolding/grails-app/init/com/example/Application.groovy:
##########
@@ -23,16 +23,32 @@ import grails.boot.config.GrailsAutoConfiguration
import groovy.transform.CompileStatic
import org.grails.datastore.gorm.timestamp.AuditorAware
-import org.springframework.context.annotation.Bean
+import org.springframework.security.config.Customizer
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.web.SecurityFilterChain
@CompileStatic
class Application extends GrailsAutoConfiguration {
static void main(String[] args) {
GrailsApp.run(Application, args)
}
- @Bean
- AuditorAware<String> auditorAware() {
- return new SpringSecurityAuditorAware()
+ def beans = {
+ bean('auditorAware', AuditorAware, SpringSecurityAuditorAware)
+
+ // Spring Boot's default chain, with the static resources the browser
fetches on its own
Review Comment:
Trimmed to one line in 1cdc252c05. The "why" of the whole thing is in the
commit message and PR description; the one thing the code itself does not say
is why a favicon needs a rule at all.
##########
grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/lang/groovy/application.rocker.raw:
##########
@@ -72,7 +72,9 @@ class Application extends GrailsAutoConfiguration {
bean('filterChain', SecurityFilterChain) { HttpSecurity http ->
http
.authorizeHttpRequests {
- it.requestMatchers('/', '/index', '/index.gsp', '/error',
'/assets/**').permitAll()
+ // The browser fetches the favicon on its own, also for
the login and logout pages;
Review Comment:
You are right that the app's own pages declare it: `main.gsp` has
`<asset:link rel="icon" href="favicon.ico"/>`, so for those the browser fetches
`/assets/favicon.ico`, which was already permitted. It is Spring Security's
*generated* `/login` and `/login?logout` pages that declare no icon, so for
those the browser falls back to `/favicon.ico` — the access log in the
description shows exactly that fetch right after `/login?logout` and `/login`.
Under `anyRequest().authenticated()` that fallback was bounced through
`/login`, which is the request that creates a session.
Comment dropped from the template in 1cdc252c05 — `'/favicon.ico'` next to
`'/assets/**'` reads as static resources without it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
