[I] isFullyAuthenticated() leads to redirect-loop [grails-core]

["robertoschwald (via GitHub)" <gi...@apache.org>]

robertoschwald opened a new issue, #15877:
URL: https://github.com/apache/grails-core/issues/15877

   In Grails 3.3.x, isFullyAuthenticated() /  IS_FULLY_AUTHENTICATED rule does not work as expected.
   
   When accessing a resource secured by isFullyAuthenticated() using remember-me, a redirect to LoginController.full() is expected, but a redirect loop between login and protected resource happens until the browser gives up.
   
   ### Steps to Reproduce
   1. Secure a resource in staticRules or interceptUrlMap with IS_AUTHENTICATED_FULLY or  isFullyAuthenticated() el expression.
   2. Login using remember-me
   3. Close browser, and re-access the application to login using remember-me
   4. Access the IS_AUTHENTICATED_FULLY  secured resource
   
   ### Expected Behaviour
   Re-login page is shown
   
   ### Actual Behaviour
   Redirect loop between login and protected resource happens until the browser gives up.
   It seems no AuthenticationException is thrown on a remember-me access to a isFullyAuthenticated() resource, therefore LoginController.auth() is called, and not LoginController.full()
   
   ### Environment Information
   - **Operating System**: OSX 10.14
   - **GORM Version:** 6
   - **Grails Version (if using Grails):** Tested with 3.3.5 and 3.3.8
   - **JDK Version:** 1.8_181 Zulu
   - **Plugin version:** 3.2.3
   
   ### Example Application
   Example simple project showing the problem see https://github.com/robertoschwald/spring-security-core-fully-auth-error


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org