useHeaderCheckChannelSecurity doesn't work for AJAX calls

[kuceram]

When I run Spring Security behind the load balancer I set http header 'X-Forwarded-Proto' sent from load balancer to Grails set to 'http'. In Grails app I set following:

grails.plugin.springsecurity.secureChannel.useHeaderCheckChannelSecurity = true
grails.plugin.springsecurity.portMapper.httpPort = 80
grails.plugin.springsecurity.portMapper.httpsPort = 443
grails.plugin.springsecurity.secureChannel.secureHeaderName = 'X-Forwarded-Proto'
grails.plugin.springsecurity.secureChannel.secureHeaderValue = 'http'
grails.plugin.springsecurity.secureChannel.insecureHeaderName = 'X-Forwarded-Proto'
grails.plugin.springsecurity.secureChannel.insecureHeaderValue = 'https'

This should set all redirect urls (login success url, etc.) to https even if grails runs on http. However for AJAX login it still uses http. I found someone had similar issue with grails 2:

http://stackoverflow.com/questions/27413217/how-to-get-springsecurity-grails-to-play-nicely-with-a-load-balancer-that-is-ter

The only workaround I found is to set full urls of AJAX callbacks:

grails.plugin.springsecurity.successHandler.ajaxSuccessUrl = "https://my-app.com/backend/login/ajaxSuccess"
grails.plugin.springsecurity.failureHandler.ajaxAuthFailUrl = "https://my-app.com/backend/login/ajaxAuthfail"
grails.plugin.springsecurity.logout.filterProcessesUrl = "https://my-app.com/backend/login/j_spring_security_logout"

Original idea from:
http://stackoverflow.com/a/26275028/607038

I assume this is an issue of Spring Security.

Tags: j_spring_security_logout, j_spring_security_check

[burtbeckwith]

Fixed, will be in the next release of 2.0 and 3.0

[kuceram]

Works fine!