Remember me doesn't work correctly with an ajax request

[codeconsole]

• User Logged in with Remember Me
• Session Times out (usually after 30 minutes)
• Left browser window open and proceeds to make Ajax request

Request returns a status code 302 with a redirect to '/login/ajaxSuccess' or whatever is defined as the ajaxSuccessUrl

    authenticationSuccessHandler(AjaxAwareAuthenticationSuccessHandler) {
  			requestCache = ref('requestCache')
  			defaultTargetUrl = '/'
  			alwaysUseDefaultTargetUrl = false
  			targetUrlParameter = 'spring-security-redirect'
  			ajaxSuccessUrl = '/login/ajaxSuccess'
  			useReferer = false
  			redirectStrategy = ref('redirectStrategy')
  		}

Correct behavior should be to process the request as normal as the user is already logged in from RemeberMeServices

[sdelamo]

Could you provide a sample application?

[mamunsrdr]

Same issue grails 3.3.2 and plugin with 3.2.0. example uploaded: https://github.com/mamunsrdr/grails-sec-issue.
stated in #527 case 3.

[mattnicolls]

I'm having this issue as well. In my case, the request is redirected to ajaxSuccess, returns a 200 success, and the response body looks like this { success: true, username='...' }. This was particularly frustrating because my javascript code was looking for success===true in the response handler. So between the 200 HTTP CODE and the success: true in the response body, my code (and the end user) believed the request went through and all was well.

Unfortunately this was not the case, and I think I know why. If the originating request was a GET, then after spring security intercepted the request, redirected to login, login processed the remember_me logic, it could then redirect back to the original GET request. But in my case it is a POST, and you cannot redirect a POST request.

So I need to scour my app code looking for POST/PUT requests and adding some logic to auto retry my request in this scenario - which is really a pain. It would be better if spring security would re-login the user without doing any redirect at all.

I'll look into the grails remember-me config to see if there is a way to do this...

[lucyhebert]

Hello, I have the same problem here, is there anything new about this, or maybe there is a workaround?