Skip to main content

Acegi Security - fails to process login with a landing page having dynamic jsp:include

I spent 10 mins in vain to aptly Title this post. but I still dont think I did justice.

While working with Acegi, I discovered a problem in a srange use case.

this post assumes intermediate-advanced level knowledge of Acegi

Acegi has a SecurityContextHolderAwareRequestFilter that filters requests accessing secure pages when SecurityContextHolder doesnot have a securityToken yet. So if user accesses /root/secure/resource , and he is not yet logged in, the request is redirected to /login (defined in AuthenticationProcessingFilterEntryPoint)

now, The request uri along with params if any are wrapped into SavedRequestWrapper, so it can be used to redirected to once the login is successful.

The SavedRequestWrapper implments HttpServletRequest so a getParam on this will return the params from /login request first and then /root/secure/resource after the redirect.

This is simple so far. But when the /root/secure/resource has a jsp:include page="/root/secure/resource2" things get complicated if both resources have some param keys. say:

/root/secure/resource?action1=method1 and included jsp is /root/secure/resource2?action2=metod2
and /root/secure/resource?action=method1 is accessed with out login

So the filter saves this request and creates a redirects it to /login once you login, The jsp:include kicks in, and adds the method2 to the action param so request will now have action2=method2&action1=method1. However, The saved request is trying to redirect all successfully logged in requests with a param map action=method1, so we lost method have a null value for action2.

I raised a bug ( and someone already fixed it )in Spring JIRA. How?

By always letting the new request supercede the old one.
Labels:

Popular posts from this blog

Powered By

As it goes, We ought to give thanks to people who power us. This page will be updated, like the version page , to show all the tools, and people this site is Powered By! Ubuntu GIMP Firebug Blogger Google [AppEngine, Ajax and other Apis] AddtoAny Project Fondue jQuery
Read More >>

Decorator for Memcache Get/Set in python

I have suggested some time back that you could modularize and stitch together fragments of js and css to spit out in one HTTP connection. That makes the page load faster. I also indicated that there ways to tune them by adding cache-control headers. On the server-side however, you could have a memcache layer on the stitching operation. This saves a lot of Resources (CPU) on your server. I will demonstrate this using a python script I use currently on my site to generate the combined js and css fragments. So My stitching method is like this @memize(region="jscss") def joinAndPut(files, ext): res = files.split("/") o = StringIO.StringIO() for f in res: writeFileTo(o, ext + "/" + f + "." + ext) #writes file out ret = o.getvalue() o.close() return ret; The method joinAndPut is * decorated * by memize. What this means is, all calls to joinAndPut are now wrapped (at runtime) with the logic in memize. All you wa...
Read More >>

Faster webpages with fewer CSS and JS

Its easy, have lesser images, css and js files. I will cover reducing number of images in another post. But If you are like me, You always write js and css in a modular fashion. Grouping functions and classes into smaller files (and Following the DRY rule, Strictly!). But what happens is, when you start writing a page to have these css and js files, you are putting them in muliple link rel=style-sheet or script tags. Your server is being hit by (same) number of HTTP Requests for each page call. At this point, its not the size of files but the number server roundtrips on a page that slows your page down. Yslow shows how many server roundtrips happen for css and js. If you have more than one css call and one js call, You are not using your server well. How do you achieve this? By concatinating them and spitting out the content as one stream. So Lets say I have util.js, blog.js and so.js. If I have a blog template that depends on these three, I would call them in three script tags. Wh...
Read More >>