Acegi Security Issue

0
votes

I have the following security config (i.e. http channel requirements) for my webapp:

<bean id="channelProcessingFilter" class="org.acegisecurity.securechannel.ChannelProcessingFilter">
    <property name="channelDecisionManager"><ref bean="channelDecisionManager"/>
    <property name="filterInvocationDefinitionSource">
        <value>
            ...
            \A/.*.html\Z=REQUIRES_INSECURE_CHANNEL
    </value>
    </property>
</bean>

where all *.html URLs require http access (insecure channel). This explains why I’m seeing https requests switch to http. When I change the config to require https access (secure channel), then I can’t get to the page via http.

My questions is: Does anyone know if it’s possible to allow either http or https access?

1
spring-security
How about just NOT configuring a channelProcessingFilter? Or making sure no rule are applied to any URl ending in ".html"? The processingFilter will then ignore these URLs, and let the request be processed - bug
Unfortunately, I have to use a filter in this case because insecure channels are required in general. Thanks though. - Joe

1 Answers

0
votes

Turns out that there exists a setting called ANY_CHANNELS in some implementations. Unfortunately, not mine.