You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by "arjangch (via GitHub)" <gi...@apache.org> on 2025/10/18 15:49:17 UTC
[I] Grails 7, Removing user still has access. [grails-spring-security]
arjangch opened a new issue, #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184
### Expected Behavior
I stop the app and remove Admin user from BootStrap, i expect Admin user has no access any more.
### Actual Behaviour
Even Admin user does exist anymore. I can verify that from H2-DB and in grails-spring-security-ui:7.0.0-RC2 console.
Admin user still has access to the app.
You can go page to page no problem. You are still Amin. Even admin user doesn't exist.
### Steps To Reproduce
1. create an app with 'grails-spring-security:7.0.0-RC2' or 'grails-spring-security-ui:7.0.0-RC2'.
2. add Admin user and role from BootStrap.groovy
3. Create an GSP page with tags <sec:username/> or <sec:loggedInUserInfo field='username'/>
4. start the app.
5. login with Remember Me checked.
6. All work correctly
7. Don't close browser
8. turn OFF the app
9. remove Admin from BootStrap.groovy
10. Start app
11. go back to browser
12. Shift-Reload browser,
13. tags <sec:username/> or <sec:loggedInUserInfo field='username'/> still think you are login as Admin
You can go page to page no problem. You are still Amin. Even admin user doesn't exist.
### Environment Information
java=21.0.8-zulu
gradle=8.14.3
groovy=4.0.28
grails=7.0.0-RC2
### Example Application
https://github.com/arjangch/grails-project-helper/tree/main/example3
### Version
7.0.0-RC2
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "jdaugherty (via GitHub)" <gi...@apache.org>.
jdaugherty commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3491971074
This sounds like its expected behavior of including devtools. This doesn't seem like a bug. @arjangch you would agree?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "arjangch (via GitHub)" <gi...@apache.org>.
arjangch commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3418603554
Is this related to https://github.com/apache/grails-spring-security/issues/1183 ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "arjangch (via GitHub)" <gi...@apache.org>.
arjangch commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3474760289
Steps 1-12 above the same result
Step 8. stop the app ctrl-c in command line
Comment out `org.springframework.boot:spring-boot-devtools` in gradle.groovy
Step 10. grails run-app
Step 11. db-console got kicked out
Tag `<sec:loggedInUserInfo field='username'/>` doesn't show any username
Main page asking me to login
It seems that is working as it should if i comment out boot:spring-boot-devtools.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3418998327
To clarify:
The app is fully stopped and restarted and the `admin` user, which was present in the db, is not longer in the db?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3493040379
Until we have another open source reloading tool, I'd say Spring Boot Dev tools should be included by default in generated applications, as it has since Grails 4. There is already a comment on it around large applications, and we could add this detail to that comment.
We will need to update documentation for Grails Spring Security.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "bkoehm (via GitHub)" <gi...@apache.org>.
bkoehm commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3512464542
If anyone is interested, the reason why `spring-boot-devtools` is changing behavior is because it is setting `server.servlet.session.persistent=true`. I did some testing on this and found that Spring Boot / Spring Security (no Grails) will show this same behavior when `server.servlet.session.persistent=true` (which is false by default).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "arjangch (via GitHub)" <gi...@apache.org>.
arjangch commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3419625745
Double check in different laptop. Using FF browser. Using the same Example3 app in my github.
1. Create Admin user and role from BootStrap
2. grails run-app
3. Check h2-db console. Admin is there. `SELECT * FROM "user"`
4. login as admin / admin
5. Check tags <sec:ifNotLoggedIn> and <sec:username/> and <sec:loggedInUserInfo field='username'/> are all working fine. Click around Admin should have access to everything.
6. Don't close tab.
7. Don't logout
8. stop the app ctrl-c in command line
9. comment out admin user in BootStrap
10. grails run-app
11. Check h2-db console. You are kicked out you need to login again to h2-db console
12. `SELECT * FROM "user"` admin user is not there any more
13. go back to browser
14. Shift-reload the page
15. Admin user still showing in <sec:ifNotLoggedIn> and <sec:username/>
16. in testSpringTags.gsp page <sec:loggedInUserInfo field='username'/> is showing admin user
17. click around. Everything working fine.
18. click on Logout button
19. you are logged out
20. try to login with admin / admin
21. you are not able to login because admin user doesn't exist.
It behaves like it is cached in cookie in browser. Does Remember Me has anything to do with this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "arjangch (via GitHub)" <gi...@apache.org>.
arjangch commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3493001103
Correct, it is not a bug.
However, does devtools need to be included in default grails project (out of the box). Or should grails-spring-security doc say remove devtools?
I am sure other people (like me) don't pay attention.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "matrei (via GitHub)" <gi...@apache.org>.
matrei commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3471566856
@arjangch Could you try running the app without Spring Boot Devtools?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Grails 7, Removing user still has access. [grails-spring-security]
Posted by "arjangch (via GitHub)" <gi...@apache.org>.
arjangch commented on issue #1184:
URL: https://github.com/apache/grails-spring-security/issues/1184#issuecomment-3419652251
Just for fun of it. Clean server between restart made no difference.
8.1. gradle clean
8.2. grails clean
8.3. rm -rf build
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@grails.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org