Question

Grails 1.3.6
Tomcat6

I created a production ROOT.war. Deleted the default tomcat ROOT directory. Deployed the ROOT.war and started tomcat. The app kicks off just fine. However, it seems like the spring security filter isn’t processing correctly. For starters, I can access protected pages but errors are thrown because of not being able to access the logged in principal. Another issue if that after I submit login creds, the server is returning an NPE and HTTP status code of 500 on http://host:8080/j_spring_security_check.

I should note that locally I have app.context=/ in application.properties and everything locally works just fine at http://localhost:8080/

Anyone have any ideas here?

UPDATE: For whatever reason, this time around I got more of a stacktrace for the NPE so I am posting it here

java.lang.NullPointerException

    at org.apache.tomcat.util.buf.ByteChunk.equalsIgnoreCase(ByteChunk.java:563)

    at org.apache.tomcat.util.buf.MessageBytes.equalsIgnoreCase(MessageBytes.java:335)

    at org.apache.tomcat.util.http.MimeHeaders.getValue(MimeHeaders.java:289)

    at org.apache.tomcat.util.http.MimeHeaders.getHeader(MimeHeaders.java:318)

    at org.apache.coyote.Request.getHeader(Request.java:330)

    at org.apache.catalina.connector.Request.getHeader(Request.java:1877)

    at org.apache.catalina.connector.RequestFacade.getHeader(RequestFacade.java:643)

    at javax.servlet.http.HttpServletRequestWrapper.getHeader(HttpServletRequestWrapper.java:80)

    at org.codehaus.groovy.grails.plugins.springsecurity.SpringSecurityUtils.isAjax(SpringSecurityUtils.java:299)

    at org.codehaus.groovy.grails.plugins.springsecurity.AjaxAwareAuthenticationSuccessHandler.determineTargetUrl(AjaxAwareAuthenticationSuccessHandler.java:42)

    at org.springframework.security.web.authentication.AbstractAuthenticationTargetUrlRequestHandler.handle(AbstractAuthenticationTargetUrlRequestHandler.java:67)

    at org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler.onAuthenticationSuccess(SimpleUrlAuthenticationSuccessHandler.java:42)

    at org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler.onAuthenticationSuccess(SavedRequestAwareAuthenticationSuccessHandler.java:63)

    at org.codehaus.groovy.grails.plugins.springsecurity.AjaxAwareAuthenticationSuccessHandler.onAuthenticationSuccess(AjaxAwareAuthenticationSuccessHandler.java:65)

    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.successfulAuthentication(AbstractAuthenticationProcessingFilter.java:301)

    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:218)

    at org.codehaus.groovy.grails.plugins.springsecurity.RequestHolderAuthenticationFilter.doFilter(RequestHolderAuthenticationFilter.java:40)

    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:378)

    at org.codehaus.groovy.grails.plugins.springsecurity.MutableLogoutFilter.doFilter(MutableLogoutFilter.java:79)

    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:378)

    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79)

    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:378)

    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:167)

    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)

    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)

    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

    at org.codehaus.groovy.grails.web.servlet.mvc.GrailsWebRequestFilter.doFilterInternal(GrailsWebRequestFilter.java:69)

    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)

    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

    at org.codehaus.groovy.grails.web.filters.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:65)

    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)

    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)

    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)

    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)

    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)

    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)

    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)

    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)

    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)

    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)

    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)

    at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)

    at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)

    at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)

    at java.lang.Thread.run(Thread.java:636)

Answer 1

It looks like the application’s doing a request.getHeader(ajaxHeaderName), where name is:

String ajaxHeaderName = (String)ReflectionUtils.getConfigProperty("ajaxHeader");

(See isAjax() at line 294 here)

The default value for ajaxHeader is 'X-Requested-With' (here).

Are you explicitly setting the configuration value to something different in prod?

This isn’t a very definitive answer, but maybe it’ll send you down the right debugging path.