Grails spring security core plugin: how to remove the browser prompt for an ajax request

ajax, grails, spring-security

Solution

In this case as HTTP Basic Authentication is being used (`useBasicAuth = true`), the server returns a 401 reply with `WWW-Authenticate: Basic`, to which the browser replies with a popup for username and password.

That behaviour is present in all browsers and cannot be changed, but there are several alternatives. To avoid the popup we can't use Basic Authentication, but some other mechanism.

The simplest way is to use another header other than the `Authorization` header (used in Basic authentication) to pass the credentials.

To configure spring security to look for credentials on this new header, have a a look at the 17.2.1 section Request-Header Authentication, where an example is given of how to configure a `RequestHeaderAuthenticationFilter` to look into a given header.

This is how the configuration looks for using a header named `X-MyCustomHeader` to pass the credentials:

  <security:http>
    <!-- Additional http configuration omitted -->
    <security:custom-filter position="PRE_AUTH_FILTER" ref="customAuthFilter" />
  </security:http>

    <bean id="customAuthFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter">
    <property name="principalRequestHeader" value="X-MyCustomHeader"/>
    <property name="authenticationManager" ref="authenticationManager" />
  </bean>

  <bean id="preauthAuthProvider"
class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <property name="preAuthenticatedUserDetailsService">
      <bean id="userDetailsServiceWrapper"
          class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
        <property name="userDetailsService" ref="userDetailsService"/>
      </bean>
    </property>
    </bean>

    <security:authentication-manager alias="authenticationManager">
      <security:authentication-provider ref="preauthAuthProvider" />
    </security:authentication-manager>

In general for frontend applications is better not to use basic authentication, as browsers cache those credentials making such an application vulnerable to request forgery (CSRF) attacks.

Problem

Original source