Grails spring security issue with url redirection coming from a desktop app

[illyad]

I've a problem with spring security core plugin

I've a excel spreadsheet and one cell has a link to a resource of my webapp (eg. http://localhost:8080/myapp/item/1)

If I click the link, it opens the browser (the same where I'm already logged in) and instead of going to the url that I clicked, it sends me to home (default target url)...

I've changed the bean authenticationProcessingFilter and I log what is happening in the doFilter and this is what I get

    http://localhost:8080/myapp/item/1
    E5E79669EBC938953AC6DCA4F1D38D56 <- this is the session id
    false <- just printing if I'm logged in
    http://localhost:8080/myapp/login/auth
    1446A2704FC61E6304F0AC95F8BDAF22 <- this is the session id, and now is different
    true <- just printing if I'm logged in
    http://localhost:8080/myapp/home
    1446A2704FC61E6304F0AC95F8BDAF22 <- this is the session id
    true <- just printing if I'm logged in

I don't know why it changes the session id, this all happens in the override doFilter of UsernamePasswordAuthenticationFilter

    public class MyAuthFilter extends RequestHolderAuthenticationFilter {
     
       @Override
    public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException {
    HttpServletRequest r2 = (HttpServletRequest)request;
    println r2.getSession().getId();
    super.doFilter(request, response, chain);
    }
    }

How can I redirect to the url that I clicked?

[smakela]

Reason for changing the session id is to prevent "Session Fixation".

http://en.wikipedia.org/wiki/Session_fixation 

http://grails-plugins.github.com/grails-spring-security-core/docs/manual/guide/19%20Session%20Fixation%20Prevention.html

[illyad]

Ok...

But it's there a way to do this?....

Like when somebody gives you a google doc url, and you can access the resource?

thanks

[illyad]

Hi...

Ok I coud fix it....

instead of going to myapp/item/1

I go to an unsecure url like myapp/item/load/1

and I've view that say something like "Loading item" and then by javascript, redirect to myapp/item/1

and it worked!

thanks