grails-spring-security-core

grails-spring-security-core copied to clipboard

In a Grails 4 webapp with Spring Security plugin dependency

org.grails.plugins:spring-security-core:4.0.0.RC2

in any controller inject dependencies

def springSecurityService
def sessionRegistry

and include this snippet in an action A:

println 'principal:   ' + springSecurityService.principal?.username
println 'currentUser: ' + springSecurityService.currentUser
println '-------------'
println 'principal sessions: ' + sessionRegistry.getAllSessions(springSecurityService.principal, true)
println 'all principals:     ' + sessionRegistry.allPrincipals.collect { it.username }

Steps to Reproduce

1. run webapp
2. login with valid credentials
3. execute action A
4. trigger a fast reload (Spring Dev Tools)
5. execute action A again

Expected Behaviour

Both snippets should print

principal:   [email protected]
currentUser: UserDomainClass(email:[email protected])
-------------
principal sessions: [org.springframework.security.core.session.SessionInformation@644c9f8a]
all principals:     [[email protected]]

Actual Behaviour

2nd execution shows session registry being erased, while principal is maintained as expected

principal:   [email protected]
currentUser: UserDomainClass(email:[email protected])
-------------
principal sessions: []
all principals:     []

Environment Information

• Operating System: macOS Mojave (10.14.6)
• GORM Version: 7.0.0
• Grails Version (if using Grails): 4.0.1
• JDK Version: 1.8.0_60