AppFuseSecuritySettings

NOTE: These instructions apply to AppFuse versions < 1.8. AppFuse has used Acegi Security since the 1.8 release.

Security Settings in AppFuse

This page is intended to be a catch-all for security related configurations in AppFuse. Most of the security settings are found in one file /metadata/web/web-security.xml. By default, all actions require a login except the PasswordHintAction and SignupAction. But only actions are protected. So all static content, or other resource mappings that don't match the pattern *.html do not require a login to access.

Allowing an action to be accessed without a login.

...
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Unrestricted</web-resource-name>
            <description>All users can view</description>
            <url-pattern>/passwordHint.html</url-pattern>
            <url-pattern>/signup.html</url-pattern>

            <!-- Allow MyAction to be accessed with out a login -->
            <url-pattern>/myaction.html</url-pattern>

            <http-method>POST</http-method>
            <http-method>GET</http-method>
        </web-resource-collection>
...

Force a page/action to use SSL

    <appfuse:secure/>

A couple of other methods from this mail list thread:

1. Secure your Action programmatically by requiring that it uses https. This works, but doesn't encrypt any data b/w the user's browser and your action. Below is an example from ActionFilter.

        String redirectString =
            SslUtil.getRedirectString(request, 
                    config.getServletContext(),
                    secure.booleanValue());

        if (redirectString != null) {
            if (log.isDebugEnabled()) {
                log.debug("protocol switch needed, redirecting to '" +
                        redirectString + "'");
            }

            // Redirect the page to the desired URL
            response.sendRedirect(response.encodeRedirectURL(redirectString));

            // ensure we don't chain to requested resource
            return;
        }

2. Secure URL patterns in web.xml and set a constraint to TRANSPORT-GUARANTEE.