Comments on: Basic Authentication and Grails http://awalkingcity.com/blog/2008/03/07/basic-authentication-and-grails/ Wed, 21 Dec 2011 12:24:53 +0000 hourly 1 http://wordpress.org/?v=3.1.2 By: Sebastian http://awalkingcity.com/blog/2008/03/07/basic-authentication-and-grails/comment-page-1/#comment-498 Sebastian Fri, 25 Mar 2011 13:56:02 +0000 http://awalkingcity.com/blog/?p=12#comment-498 Thanks for the tip. One small bug in Romains code: <code> if(!ValidationUtil.validate(request,response, log, grailsApplication)){ render(text: "User not known.") return } } </code> must read <code> if(!ValidationUtil.validate(request,response, log, grailsApplication)){ render(text: "User not known.") return <em>false</em> } } </code> in order to prevent execution of the action if the user is not logged in. Thanks for the tip. One small bug in Romains code:


if(!ValidationUtil.validate(request,response, log, grailsApplication)){
render(text: "User not known.")
return
}
}

must read


if(!ValidationUtil.validate(request,response, log, grailsApplication)){
render(text: "User not known.")
return false
}
}

in order to prevent execution of the action if the user is not logged in.

]]> By: Romain http://awalkingcity.com/blog/2008/03/07/basic-authentication-and-grails/comment-page-1/#comment-495 Romain Thu, 24 Feb 2011 10:31:19 +0000 http://awalkingcity.com/blog/?p=12#comment-495 I changed you code in order to log with a login and password in the configuration file. I also add the WWW-Authenticate in order to respect the standard : <code> response.addHeader("WWW-Authenticate", "Basic realm=\"Secure Area\"") </code> <code> class SecurityFilters { def grailsApplication def filters = { basicAuth(controller: 'prospect', action: '*') { before = { if(!ValidationUtil.validate(request,response, log, grailsApplication)){ render(text: "User not known.") return } } } basicAuth(controller: 'hash', action: '*') { before = { if(!ValidationUtil.validate(request,response, log, grailsApplication)){ render(text: "User not known.") return } } } } } /** * Basic Authentication * return false if login failed, and true if login is successful * * The HTTP status code and the HTTP header of the response are set as this : * * "Authorization" not present in the header of the request : * - status : 401 * - add hedaer : WWW-Authenticate: Basic realm="Secure Area" * * "Authorization" present, but bad login / password * - status : 403 * */ class ValidationUtil{ static validate(def request, def response, def log, def grailsApplication){ try { def authString = request.getHeader('Authorization') if (!authString) { response.status = 401 response.addHeader("WWW-Authenticate", "Basic realm=\"Secure Area\"") return false } def encodedPair = authString - 'Basic ' def decodedPair = new String(new sun.misc.BASE64Decoder().decodeBuffer(encodedPair)); def credentials = decodedPair.split(':') def login = grailsApplication.config.admin.security.login def password = grailsApplication.config.admin.security.password if (login.equals(credentials[0]) && password.equals(credentials[1])) { return true } else { log.warn("User not known") response.status = 403 return false } } catch (Exception e) { log.warn("User not known", e) response.status = 403 return false } } } </code> I changed you code in order to log with a login and password in the configuration file.

I also add the WWW-Authenticate in order to respect the standard :

response.addHeader("WWW-Authenticate", "Basic realm=\"Secure Area\"")


class SecurityFilters {
def grailsApplication
def filters = {
basicAuth(controller: 'prospect', action: '*') {
before = {
if(!ValidationUtil.validate(request,response, log, grailsApplication)){
render(text: "User not known.")
return
}
}
}

basicAuth(controller: 'hash', action: '*') {
before = {
if(!ValidationUtil.validate(request,response, log, grailsApplication)){
render(text: "User not known.")
return
}
}
}

}
}

/**
* Basic Authentication
* return false if login failed, and true if login is successful
*
* The HTTP status code and the HTTP header of the response are set as this :
*
* "Authorization" not present in the header of the request :
* - status : 401
* - add hedaer : WWW-Authenticate: Basic realm="Secure Area"
*
* "Authorization" present, but bad login / password
* - status : 403
*
*/
class ValidationUtil{
static validate(def request, def response, def log, def grailsApplication){
try {
def authString = request.getHeader('Authorization')
if (!authString) {
response.status = 401
response.addHeader("WWW-Authenticate", "Basic realm=\"Secure Area\"")
return false
}
def encodedPair = authString - 'Basic '
def decodedPair = new String(new sun.misc.BASE64Decoder().decodeBuffer(encodedPair));
def credentials = decodedPair.split(':')
def login = grailsApplication.config.admin.security.login
def password = grailsApplication.config.admin.security.password

if (login.equals(credentials[0]) && password.equals(credentials[1])) {
return true
} else {
log.warn("User not known")
response.status = 403
return false
}
} catch (Exception e) {
log.warn("User not known", e)
response.status = 403
return false
}
}
}

]]> By: Building Blocks » Grails: Ajax Login using Basic Auth http://awalkingcity.com/blog/2008/03/07/basic-authentication-and-grails/comment-page-1/#comment-246 Building Blocks » Grails: Ajax Login using Basic Auth Tue, 07 Apr 2009 19:07:08 +0000 http://awalkingcity.com/blog/?p=12#comment-246 [...] you want. If you want a simple solution and stick with the HTTP standard you could use Basic auth. Here is a good explaination of how to implement Basic auth for Grails. Another way is too use a cookie to hold authorization [...] [...] you want. If you want a simple solution and stick with the HTTP standard you could use Basic auth. Here is a good explaination of how to implement Basic auth for Grails. Another way is too use a cookie to hold authorization [...]

]]> By: a walking city » Blog Archive » OpenID and Grails http://awalkingcity.com/blog/2008/03/07/basic-authentication-and-grails/comment-page-1/#comment-8 a walking city » Blog Archive » OpenID and Grails Thu, 20 Mar 2008 23:51:17 +0000 http://awalkingcity.com/blog/?p=12#comment-8 [...] Our final step is to set up an Authentication filter like the one we made for basic authentication . The only difference is that we have a number of controller actions that we want to allow to pass [...] [...] Our final step is to set up an Authentication filter like the one we made for basic authentication . The only difference is that we have a number of controller actions that we want to allow to pass [...]

]]>