302 Response - net::ERR_TOO_MANY_REDIRECTS

[craigweston]

I am unable to call the rest api successfully via AJAX using the plugin. I am receiving a 302 response which is causing a redirect loop.

I have tested non-authenticated, with the plugin removed and everything is work fine.

I am able to successfully call the rest api with curl:

curl -i -H "Accept: application/json" -H "Authorization:Bearer <TOKEN>" http://localhost:8084/app/api/exercise

I have the following configuration in place:

BuildConfig.groovy

        compile ':spring-security-core:2.0-RC3'
        compile ":spring-security-rest:1.4.0.RC5", {
            excludes: 'spring-security-core'
        }

Config.groovy

grails.plugin.springsecurity.rest.login.useJsonCredentials = true
grails.plugin.springsecurity.rest.token.storage.useGorm = true
grails.plugin.springsecurity.rest.token.storage.gorm.tokenDomainClassName = 'com.app.security.AuthenticationToken'
grails.plugin.springsecurity.filterChain.chainMap = [
    '/api/**': 'JOINED_FILTERS,-exceptionTranslationFilter,-authenticationProcessingFilter,-securityContextPersistenceFilter',  // Stateless chain
    '/**': 'JOINED_FILTERS,-restTokenValidationFilter,-restExceptionTranslationFilter'                                          // Traditional chain
]

I have ensured that the proper authentication token is being sent in the headers, here is a snippet from the request:

Request URL:http://localhost:8084/app/api/exercise/
Accept:application/json, text/plain, */*
Authorization:Bearer <TOKEN>

Is this a bug or is something configured incorrectly?

Thank you.

[alvarosanchez]

Please enable debugging and paste here the output.

[craigweston]

This section of the debug logs repeats several times:

matcher.AntPathRequestMatcher Checking match of request : '/api/exercise'; against '/api/**'
web.FilterChainProxy /api/exercise at position 1 of 9 in additional filter chain; firing Filter: 'RestLogoutFilter'
web.FilterChainProxy /api/exercise at position 2 of 9 in additional filter chain; firing Filter: 'MutableLogoutFilter'
web.FilterChainProxy /api/exercise at position 3 of 9 in additional filter chain; firing Filter: 'RestAuthenticationFilter'
rest.RestAuthenticationFilter Actual URI is /api/exercise; endpoint URL is /api/login
web.FilterChainProxy /api/exercise at position 4 of 9 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
web.FilterChainProxy /api/exercise at position 5 of 9 in additional filter chain; firing Filter: 'GrailsRememberMeAuthenticationFilter'
rememberme.TokenBasedRememberMeServices Remember-me cookie detected
rememberme.TokenBasedRememberMeServices Remember-me cookie accepted
hierarchicalroles.RoleHierarchyImpl getReachableGrantedAuthorities() - From the roles [ROLE_ADMIN, ROLE_EDITOR, ROLE_USER] one can reach [ROLE_ADMIN, ROLE_USER, ROLE_EDITOR] in zero or more steps.
authentication.ProviderManager Authentication attempt using org.springframework.security.authentication.RememberMeAuthenticationProvider
savedrequest.HttpSessionRequestCache DefaultSavedRequest added to Session: DefaultSavedRequest[http://localhost:8084/app/api/exercise]
web.DefaultRedirectStrategy Redirecting to 'http://localhost:8084/app/api/exercise'
savedrequest.HttpSessionRequestCache Removing DefaultSavedRequest from session if present
matcher.AntPathRequestMatcher Checking match of request : '/api/exercise'; against '/api/**'
web.FilterChainProxy /api/exercise at position 1 of 9 in additional filter chain; firing Filter: 'RestLogoutFilter'
web.FilterChainProxy /api/exercise at position 2 of 9 in additional filter chain; firing Filter: 'MutableLogoutFilter'
web.FilterChainProxy /api/exercise at position 3 of 9 in additional filter chain; firing Filter: 'RestAuthenticationFilter'
rest.RestAuthenticationFilter Actual URI is /api/exercise; endpoint URL is /api/login
web.FilterChainProxy /api/exercise at position 4 of 9 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
web.FilterChainProxy /api/exercise at position 5 of 9 in additional filter chain; firing Filter: 'GrailsRememberMeAuthenticationFilter'
rememberme.TokenBasedRememberMeServices Remember-me cookie detected
rememberme.TokenBasedRememberMeServices Remember-me cookie accepted
hierarchicalroles.RoleHierarchyImpl getReachableGrantedAuthorities() - From the roles [ROLE_ADMIN, ROLE_EDITOR, ROLE_USER] one can reach [ROLE_ADMIN, ROLE_USER, ROLE_EDITOR] in zero or more steps.
authentication.ProviderManager Authentication attempt using org.springframework.security.authentication.RememberMeAuthenticationProvider
savedrequest.HttpSessionRequestCache DefaultSavedRequest added to Session: DefaultSavedRequest[http://localhost:8084/app/api/exercise]
web.DefaultRedirectStrategy Redirecting to 'http://localhost:8084/app/api/exercise'
savedrequest.HttpSessionRequestCache Removing DefaultSavedRequest from session if present

[alvarosanchez]

Can you try removing the trailing slash?

I believe http://localhost:8084/app/api/exercise/ is being redirected to http://localhost:8084/app/api/exercise.