0

I am using grails 5.2.5 and spring security 5.6.0. When a 403 is occurred then the access deny message is written in the browser document.I want to show a 403 specific view page.But it is not working. My code as below:

URL mapping:

'403'(controller: 'error', action: 'denied')

Error controller denied action:

def denied() {
    render(view: '/error/denied', model: [errorMessage: "403 sample error"])
}

denies view page under error directory:

<section class="content">
        <h1 style="color: red">${errorMessage}</h1>
    </section>

But it does not work. Instead it writes to browser the following message:

Access to localhost was denied 
You don't have authorization to view this page.
HTTP ERROR 403

application.groovy >>

// Added by the Spring Security Core plugin:
grails.plugin.springsecurity.userLookup.userDomainClassName = 'com.org.auth.User'
grails.plugin.springsecurity.userLookup.authorityJoinClassName = 'com.org.auth.UserRole'
grails.plugin.springsecurity.authority.className = 'com.org.auth.Role'
grails.plugin.springsecurity.requestMap.className = 'com.org.auth.Requestmap'
grails.plugin.springsecurity.securityConfigType = 'Requestmap'
grails.plugin.springsecurity.controllerAnnotations.staticRules = [
    [pattern: '/',               access: ['permitAll']],
    [pattern: '/error',          access: ['permitAll']],
    [pattern: '/index',          access: ['permitAll']],
    [pattern: '/index.gsp',      access: ['permitAll']],
    [pattern: '/shutdown',       access: ['permitAll']],
    [pattern: '/assets/**',      access: ['permitAll']],
    [pattern: '/**/js/**',       access: ['permitAll']],
    [pattern: '/**/css/**',      access: ['permitAll']],
    [pattern: '/**/images/**',   access: ['permitAll']],
    [pattern: '/**/favicon.ico', access: ['permitAll']]
]

grails.plugin.springsecurity.filterChain.chainMap = [
    [pattern: '/assets/**',      filters: 'none'],
    [pattern: '/**/js/**',       filters: 'none'],
    [pattern: '/**/css/**',      filters: 'none'],
    [pattern: '/**/images/**',   filters: 'none'],
    [pattern: '/**/favicon.ico', filters: 'none'],
    [pattern: '/**',             filters: 'JOINED_FILTERS']
]

grails.plugin.springsecurity.logout.postOnly = false    // just for test

what to do?!!

Sumon Bappi
  • 1,937
  • 8
  • 38
  • 82
  • Can you show your application.groovy? I think you need to open the specific url – luisenricke Aug 10 '23 at 16:34
  • @luisenricke of course – Sumon Bappi Aug 11 '23 at 09:13
  • @luisenricke I have post a way out, if you have any better option I want to implement that – Sumon Bappi Aug 11 '23 at 09:49
  • Thanks, well... You can try two options. The first one, you need to add the specific route in `staticRules` configuration because that path of you can use is not mapped, for example you can add `[pattern: '/error/**', access: ['permitAll']],` if you have other views to handle or `[pattern: '/error/denied.gsp', access: ['permitAll']],` if you only need that view. The second one is to use the annotation of Secured and pass permitAll, something like this `@Secured(['permitAll'])` in your request. I think the best way is the first – luisenricke Aug 11 '23 at 14:17

1 Answers1

0

I find a workout by this stackoverflow.com link : configure in application.groovy.

I had to add this line in application.groovy file :

grails.plugin.springsecurity.adh.errorPage = null

Sumon Bappi
  • 1,937
  • 8
  • 38
  • 82