Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Grails 8 returning 500 error instead of 401 for an unauthenticated request

Aperta
  • Qualcosa non va?
#16,632 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
groovy
Ambito
authentication, security

Direzione di ricerca

Start with the reproduction repo linked in the issue (tprebs/grails-8-security-401-regression) and run runGrails8.sh to see the 500. The relevant code is the re-implemented FilterSecurityInterceptor and AccessDecisionVoter path in grails-spring-security-compat, where WebExpressionVoter.vote asserts on a null Authentication. Done means an unauthenticated request to a @Secured action returns 401 with no AssertionError, and the Grails 7 behaviour is matched.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Expected Behavior

An unauthenticated request to a @Secured controller should be answered with a 401 Unauthorized. When no authentication is provided grails 8 is responding with a 500 error and an page. Previous versions of grails returned 401 Unauthorized

Actual Behaviour

On 8.0.0 the same request is answered with 500 Internal Server Error and an HTML error page, and the server log carries an AssertionError.

This happens when the filter chain legitimately contains no anonymous authentication filter, so the request reaches the authorisation interceptor with a null Authentication. That is ordinary, documented
configuration, the Spring Security Core plugin's filters.adoc describes composing a chain with
JOINED_FILTERS and filter names prefixed with -, and removing anonymousAuthenticationFilter is a
deliberate choice for a stateless API that must not grant anonymous identities:

grails.plugin.springsecurity.filterChain.chainMap = [
        [
                pattern: '/**',
                filters: 'JOINED_FILTERS,-anonymousAuthenticationFilter,-exceptionTranslationFilter,' +
                        '-authenticationProcessingFilter,-securityContextPersistenceFilter,' +
                        '-rememberMeAuthenticationFilter'
        ],
]

Grails builds with no anonymous filter, as configured:

Creating filter chain: Ant [pattern='/**'],
  [SecurityRequestHolderFilter, MutableLogoutFilter, RestAuthenticationFilter,
   SecurityContextHolderAwareRequestFilter, RestTokenValidationFilter,
   ExceptionTranslationFilter, FilterSecurityInterceptor]

An unauthenticated GET /secret then produces:

ERROR o.a.c.c.C.[.[.[.[dispatcherServletRegistration] : Servlet.service() for servlet
  [dispatcherServletRegistration] threw exception [Filter execution threw an exception] with root cause

java.lang.AssertionError: authentication cannot be null. Expression: authentication. Values: authentication = null
    at grails.plugin.springsecurity.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.groovy:47)
    at grails.plugin.springsecurity.access.vote.AuthenticatedVetoableDecisionManager.decide(...)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.groovy:54)

ERROR o.a.c.c.C.[Tomcat].[localhost] : Exception Processing [ErrorPage[errorCode=500, location=/error]]
Cause

Spring Security 7.1.1 removed FilterSecurityInterceptor and the AccessDecisionManager/AccessDecisionVoter
API. Grails 8 ships org.apache.grails:grails-spring-security-compat to re-implement those classes in Spring
Security's own package namespace, which is why the stack frame above reads FilterSecurityInterceptor.groovy
rather than Spring's Java original.

The re-implementation omits the null-Authentication guard. Spring Security's
AbstractSecurityInterceptor.authenticateIfRequired() begins:

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authentication == null) {
    throw new AuthenticationCredentialsNotFoundException(
        "An Authentication object was not found in the SecurityContext");
}

AuthenticationCredentialsNotFoundException extends AuthenticationException, so
ExceptionTranslationFilter catches it and the entry point returns 401. That is the path that works on
Grails 7.

In grails-spring-security-compat:8.0.0 there is no null guard, and the null Authentication is passed to the decision manager and reaches WebExpressionVoter, whose Groovy assert throws an AssertionError. That is an Error, not an AuthenticationException, so ExceptionTranslationFilter does not catch it and the request fails as a 500.

Steps To Reproduce
  1. Create a Grails 8.0.0 application with grails-spring-security and grails-spring-security-rest.
  2. Add one controller with @Secured(['ROLE_USER']).
  3. Set the catch-all chain in grails-app/conf/application.groovy:
    [pattern: '/**', filters: 'JOINED_FILTERS,-anonymousAuthenticationFilter'] (the other exclusions above
    are not required to trigger it; removing the anonymous filter is).
  4. Request the secured action with no Authorization header: curl -i http://localhost:8080/secret.
  5. Observe HTTP 500 and an HTML error page. Expected 401.
  6. Check the server log for java.lang.AssertionError: authentication cannot be null originating in
    WebExpressionVoter.vote.
  7. Run the same application on Grails 7.2.3 and the request is answered with 401.

recreation available here https://github.com/tprebs/grails-8-security-401-regression

A minimal Grails application with one @Secured controller and two scripts:

./runGrails7.sh     # passes - answered with 401
./runGrails8.sh     # fails  - answered with 500
Environment Information
  • Grails 8.0.0
  • Gradle 9.8.0,
  • Java 21
  • macOS
Example Application

https://github.com/tprebs/grails-8-security-401-regression

Version

8.0.0

Lingua principale
Groovy
Stelle
2.9k
Fork
976
Merge medio
21h 14m
PR unite (30g)
174

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/grails-core

Tutte le issue di apache/grails-core

Issue simili

Altre issue su Security

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.