Grails spring security not showing error messages in the right locale

[ppazos]

I'm working in grails v3.2.9 / sec plugin v3.1.2.

Followed this guide to add locale selection on the GUI http://guides.grails.org/grails_i18n/guide/index.html (set locale by the lang param).

When I change the locale from the GUI, every text on the GUI changes to the selected locale without any problems.

When I try to login with a wrong user, spring security is showing the error message (code=springSecurity.errors.login.fail) always in spanish, even if english is selected.

On a different machine, the login fail message is always shown in english even if I select lang=es (spanish).

Not sure why it is not considering the locale set by the lang param and is fixing the locale for that specific message. Not sure what is the issue here. Any pointers are welcome.

This is my project: https://github.com/ppazos/notes

[ppazos]

It seems the sec plugin is using the request.locale instead of the session.'org.springframework.web.servlet.i18n.SessionLocaleResolver.LOCALE'

Here is where request.locale is used https://github.com/grails-plugins/grails-spring-security-core/search?utf8=%E2%9C%93&q=locale&type=

request.locale doesn't get updated with the lang param and the session.... is what grails 3 updates with the lang param.

By the 3.x docs, the locale should change just by using the lang param: https://docs.grails.org/latest/guide/i18n.html#changingLocales

[ppazos]

Did another test and for the same request accessed directly or via RequestContextUtils, I get different locales. Not sure if this is really an issue or expected at the Spring level. But it seems Grails uses the second while the Sec plugin uses the first, causing inconsistencies on the UI:

request.locale.toString() == 'es'
RequestContextUtils.getLocale(request).toString() == 'en'

[ddelponte]

Hi @ppazos , thank-you for submitting this issue!

I believe the behavior you are witnessing isn't a bug, it's a feature 😉

Out of the box, spring security does not retrieve request parameters from the request for reuse when initiating the redirect after a failed login attempt which may result in the behavior you are observing.

This stackoverflow post provides a possible solution: https://stackoverflow.com/questions/24787790/grails-spring-security-saved-request-empty-parameters-and-unbound-command

Adding your own custom filter to the filter chain that preserves params, specifically the lang param, may resolve this issue.

Please let me know if this approach fixes the problem.

[ddelponte]

Closing this and marking it as "not a bug"

[KeeTraxx]

I've been having this problem and all solutions I've stumbled upon were too bloated or didn't work with Grails 3.x.

IMHO, the grails-spring-security-core should get the Locale from the RequestContext instead of request.locale as @ppazos has mentioned. I don't understand why it is considered a feature that the language isn't resolved using Grails provided tools.

Anyway, the simplest solution I've come up with was to override the LoginController itself. See the gist here:

https://gist.github.com/KeeTraxx/56cb753bb1a877390df166167c4880d7

If this makes any sense, I'd gladly submit a pull request.

[mhuebner]

We implemented our own LocaleResolver. The current Version of Spring Security uses request.locale:

if (exception) {
            if (exception instanceof AccountExpiredException) {
                msg = messageSource.getMessage('springSecurity.errors.login.expired', null, "Account Expired", request.locale)
            } else if (exception instanceof CredentialsExpiredException) {
                msg = messageSource.getMessage('springSecurity.errors.login.passwordExpired', null, "Password Expired", request.locale)
            } else if (exception instanceof DisabledException) {
                msg = messageSource.getMessage('springSecurity.errors.login.disabled', null, "Account Disabled", request.locale)
            } else if (exception instanceof LockedException) {
                msg = messageSource.getMessage('springSecurity.errors.login.locked', null, "Account Locked", request.locale)
            } else if (exception instanceof SessionAuthenticationException) {
                msg = messageSource.getMessage('springSecurity.errors.login.max.sessions.exceeded', null, "Sorry, you have exceeded your maximum number of open sessions.", request.locale)
            } else {
                msg = messageSource.getMessage('springSecurity.errors.login.fail', null, "Authentication Failure", request.locale)
            }
        }

I would expect a LocaleResolver to be used. Every Grails application has per default a localeResolver bean. Why not use this one? So you are free which locale to be used.