Spring Security在生产服务器上重定向到本地主机 [英] Spring Security is redirecting to localhost on production server

问题描述

我有一个安装了spring-security-core插件的grails应用程序。一切工作正常本地。我部署到临时服务器，一切正常。我部署到我们的生产服务器，这是我们的临时服务器的镜像。我可以得到不受保护的页面。但是，当Spring Security开始尝试执行重定向时，它将重定向到本地主机，而不是grails.serverURL。

I have a grails application with the spring-security-core plugin installed. Everything works fine locally. I deployed to a staging server and everything worked fine. I deployed to our production server which is a mirror of our staging server. I can get to unprotected pages just fine. But when Spring Security kicks in and tries to do it's redirects it is redirecting to localhost instead of the grails.serverURL.

我打算将日志记录升高到可能的，并重新部署，看看我可以做任何事情的头或尾。我会在这里发布我的发现。如果任何人有过这种经历，并知道可能发生什么，请让我知道。另外，如果有任何需要查看的配置文件，我也可以提供这些文件。感谢。

I'm going to turn up logging as high as possible and redeploy to see if I can make heads or tails of anything. I'll post my finding here. If anyone has experienced this before and knows what might be happening, please let me know. Also, if there are any configuration files that need to be seen I can provide those as well. Thanks.

更新
我在底部添加了以下内容Config.groovy

Update I added the following to the bottom Config.groovy

grails.plugins.springsecurity.useSecurityEventListener = true

grails.plugins.springsecurity.onAuthorizationEvent = { e, appCtx ->
   println "here"
   println e
}

在本地，当我尝试访问受保护的页面时，该关闭命中了两次。一次为最初的网址。第二次验证网址。

Locally, that closure gets hit 2 times when I try and access a protected page. Once for the initial url. Second time for the auth url. Deployed this to our production server and I get nothing.

推荐答案

重定向在 org.springframework .security.web.authentication.LoginUrlAuthenticationEntryPoint.commence（） 方法，所以你可以在那里设置一个断点，如果你能够借用其中一个用于调试的prod服务器。

The redirects are done in org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint.commence() method, so you could set a breakpoint there if you're able to borrow one of the prod servers for debugging.

它基于登录表单URI（例如/ login / auth）构建重定向URL，但它使用请求。 getServerName（），所以它应该与原始请求相同。请注意， grails.serverURL 在这里没有影响，因为它使用请求的服务器名称，端口，上下文等来构建URL。

It builds the redirect URL based on the login form uri (e.g. /login/auth) but it uses request.getServerName() so it should be the same as the original request. Note that grails.serverURL has no impact here since it builds the URL using the requested server name, port, context, etc.

可能会将Apache或负载均衡器放在您的servlet容器的前面，尽管我已经完成了这两项工作，并且工作正常。

It might be affected by putting Apache or a load balancer in front of your servlet container, although I've done both and it's worked fine.

你有没有在 resources.groovy 中做了任何可能影响这个bean的定制？

Have you done any bean customization in resources.groovy that might affect this?

这篇关于Spring Security在生产服务器上重定向到本地主机的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！