getting my filter to run *before* spring-security filter chain

[tony_k]

i currently have a filter defined in conf/SomethingFilters.groovy,
and i would like to get that to run before the spring-security filter chain.

looking for suggestions on the best way to accomplish that.

my research has yielded references to several discussions regarding:

(1) grails "depends on", but this requires access to the filter you want to run *after*,
and i don't have ready access to that since it is defined by spring-security plugin.
if there was a "run before" mechanism and i knew the identifier of the spring-security chain,
i could use something like that.

(2) spring-security order insertion, but my filter isn't strictly security related,
so it seems odd to have to have to wedge it into that chain

(3) "brute force" it somehow by generating the web.xml template and attempting to effect it there

i'm still a grails noob, so i'm always looking for opinions from the more experienced.

thanks,
tony.

[burtbeckwith]

Grails filters are confusingly named for users with Spring experience since they're wrappers for Spring HandlerInterceptors, not servlet filters. So the dependsOn stuff for Grails filters wouldn't apply since the servlet filters have already fired when Grails filters run.

So you'd need to either add your filter to the plugin's chain even though it's not security-related, or add it to web.xml. To edit web.xml run "grails install-templates" and edit src/war/web.xml. The final filter-mapping order will be

1. charEncodingFilter
2. hiddenHttpMethod
3. grailsWebRequest
4. springSecurityFilterChain
5. sitemesh
6. urlMapping

Burt

[tony_k]

hi burt,

i didn't realize what grails calls a "filter" is actually a spring handler-interceptor.

probably your previous disclosure of the lesser known fact that the "model" is actually available
from the "after" filter should have tipped me off...

appreciate the relevant (and timely) info!

thanks again,
tony.

[tony_k]

so i installed templates and added a filter to web.xml like so:

	<filter>
		<filter-name>myFilter</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>

	<filter-mapping>
		<filter-name>myFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

but i'm trying to access a session scoped bean in the filter implementation, and i'm getting:

Caused by: java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally receiving thread? If you are actually operating within a web request and still receive this message, your code is probably running outside of DispatcherServlet/DispatcherPortlet: In this case, use RequestContextListener or RequestContextFilter to expose the current request.
	at org.springframework.web.context.request.RequestContextHolder.currentRequestAttributes(RequestContextHolder.java:131)
	at org.springframework.web.context.request.SessionScope.get(SessionScope.java:90)
	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:325)
	... 23 more

i'm thinking my filter needs to appear after "grailsWebRequest" (and yet before "springSecurityFilterChain" per my original issue),
but it's not clear to me how to effect this as neither of the filter-mapping elements i (in theory) need to sandwich in between are present in the template...?

[tony_k]

after further analysis, it looks like the "No thread-bound request" thing was a result of an earlier exception,
but being able to wedge a filter somewhere in between the core grails filters is still an interesting question.

i recall an associate of mine modifying the final web.xml via a plugin,
would that be the path to take or is there something you can do without a plugin?

[panwaskard]

Tony did you resolve this. I've tried the same generated the template and added the filter but get the folowing error:

Caused by: java.lang.IllegalArgumentException: Filter mapping specifies an unknown filter name hiddenHttpMethod
at org.apache.catalina.core.StandardContext.addFilter Map(StandardContext.java:2251)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Nativ e Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Native MethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(De legatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.tomcat.util.IntrospectionUtils.callMeth od1(IntrospectionUtils.java:925)
at org.apache.tomcat.util.digester.SetNextRule.end(Se tNextRule.java:193)
at org.apache.tomcat.util.digester.Rule.end(Rule.java :229)
at org.apache.tomcat.util.digester.Digester.endElemen t(Digester.java:1140)
... 433 more