2

I need to have certain URLs (actions) in my app where I receive Credit Card information be SSL/https. I'm using the new set of Grails security plugins, i.e. Spring Security Core, and Spring Security UI. These apparently replace the ACEGI security plugin, which I understand had some SSL configuration capabilities at the controller level.

Can you tell me what the current recommendation is for switching to https for certain controllers/actions? Do I need to resolve everything in Tomcat?

Thanks

3
  • Yah thanks, I saw that. But I need to understand down to the controller / action level, making some https and some not. Also, I have seen references to using the ACEGI plugin for this, but apparently the new security plugins supersede it, yet don't give this type of SSL support.
    – Ray
    Aug 26, 2011 at 0:15
  • edit - see burt's answer -- its right there in the docs
    – hvgotcodes
    Aug 26, 2011 at 1:24

1 Answer 1

4

See section "17 Channel Security" in the Spring Security Core plugin docs: http://grails-plugins.github.com/grails-spring-security-core/docs/manual/

7
  • Thanks Burt, I searched under SSL and didn't find this section -- thanks for pointing it out. I tried a few maps and had a seemingly strange result: doing '/member/**': 'REQUIRES_SECURE_CHANNEL', '/**': 'REQUIRES_INSECURE_CHANNEL' did not work, it created a URL, localhost:8080/connect/grails/member/list.dispatch, putting a "grails" in the path. However, doing a map: '/member/**': 'REQUIRES_SECURE_CHANNEL', '/group/**': 'REQUIRES_INSECURE_CHANNEL' did work for member , and made the group controller, and all others I tested, insecure, which is what I want. Is the first incorrect?
    – Ray
    Aug 26, 2011 at 2:36
  • I wish comments supported formatting, hopefully it is readable.
    – Ray
    Aug 26, 2011 at 2:37
  • Any time you map /** to something you need to consider the implications for every possible url, e.g. it's easy to block access to the favicon with a wildcard rule. Do you really require that non-member URLs be accessed without SSL? It seems like you could just remove that wildcard and only specify that certain patterns require SSL. Aug 26, 2011 at 2:53
  • Click the 'help' link when typing your comments - it has examples of the simplified markup syntax allowed in comments. Aug 26, 2011 at 2:54
  • Burt - Thanks for your responses. If I only specify the /member controller as secure, either all of member or a specific action, once I go to it, all other controllers get accessed via https. It's almost like it switches modes -- something turns https on, and then something must be accessed to turn it back off. I guess I could cause that to happen -- take the user to a URL that is marked insecure after the secure stuff is done / submitted, e.g. a welcome or thank you page.
    – Ray
    Aug 26, 2011 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.