Take the 2-minute tour ×

I have a sub dir inside my images folder that is a symlink to a network drive. This allows us to store the thousands of images in a place better suited.

If an authenticated user has accessed a page that loads these images, then an un authenticated user can access the direct url path of the image from their browser.

Eg, if the image path is: http://some.server.com:8080/SomeApp/static/images/gpfscc/data_storage/frameburglar/img/33/1761/some_image.jpg

It is accessable to the whole world.

I have tried configuring it several different ways using staticRules, pessimistic locking, and interceptUrlMap.

My current config.groovy looks like this:

//Too ristrictive? Could not get past login
//grails.plugins.springsecurity.rejectIfNoRule = true

//grails.plugins.springsecurity.controllerAnnotations.staticRules = [
//        '/images/gpfscc/**': ['IS_AUTHENTICATED_REMEMBERED'],
//        '/static/images/gpfscc/**': ['IS_AUTHENTICATED_REMEMBERED']

grails.plugins.springsecurity.interceptUrlMap = [
        '/secUser/**':         ['IS_AUTHENTICATED_REMEMBERED'],
        '/secUserSecRole/**':     ['IS_AUTHENTICATED_REMEMBERED'],
        '/trip/**':         ['IS_AUTHENTICATED_REMEMBERED'],
        '/collection/**':   ['IS_AUTHENTICATED_REMEMBERED'],
        '/secRole/**':         ['IS_AUTHENTICATED_REMEMBERED'],
        '/vehicle/**':      ['IS_AUTHENTICATED_REMEMBERED'],
        '/login/**':        ['IS_AUTHENTICATED_ANONYMOUSLY'],
        '/logout/**':       ['IS_AUTHENTICATED_ANONYMOUSLY'],
        '/*':               ['IS_AUTHENTICATED_ANONYMOUSLY']

The end result being that the controllers and pages have the propper security applied but the 'static' resources dont ever check for authentication.

I need to garuntee that if you some how know the url a head of time, you can not access the image with out logged in and in the right groups.

Thank you.

share|improve this question
I think that there's something about the filter order. See this topic –  Sérgio Michels Aug 14 '12 at 18:58
From what I can tell it seems that since the static url is not tied to any controller, no event is fired when you access a /static/** url. This means no filters are run. One way around this is to create a filter class, and add it to the web.xml file but I have not been particularly sucessfull with this either. The filter code never seems to be called when the URLs are hit. Links: - stackoverflow.com/questions/5668190/… - stackoverflow.com/questions/5333266/… –  btreecat Aug 14 '12 at 19:23
You can generate a war to check if your web.xml content is added with success. –  Sérgio Michels Aug 14 '12 at 20:25
I eventually found a solution. I served the contents using a motified controler response and checked the roles before serving an image or a 404 status. –  btreecat Aug 15 '12 at 18:26
Cool! I suggest you post this as answer, with some code, and mark this as correct. –  Sérgio Michels Aug 15 '12 at 18:29

Your Answer



Browse other questions tagged or ask your own question.