Finally back to work!

My exams are over, and i also finished two books on Grails and built apps from those books. Those books were: "Beginning Grails, Groovy and Griffon" with the "collab-todo" app and "Getting started with Grails, second edition" with the "racetrack" app.

Now i will have some time to dedicate to my projects.

I am purposeful and motivated. I do not wish to waste time anymore.

Beginning Grails, Groovy and Griffon security filter problem.

When i implemented a security filter in my collab-todo app, the only page the filters allowed an unregistered user to view had no styles. Turns out that the assets path was also blocked by the filter.

Thanks to Joshua Moore for answering my question.

The problem is that:

because in recent versions of Grails (2.3+) assets are served up by the asset pipeline plugin from the /assets/**URL.

So the filter should be

securityFilters(controller:'*', action:'*', uriExclude: '/assets/**'){}

instead of just

securityFilters(controller:'*', action:'*'){} 

Grails CAPTCHA

Easiest CAPTHCA implementation ever! Check here http://grails.org/plugin/simple-captcha

In BuildConfig.groovy insert this line:

compile ":simple-captcha:1.0.0"

In gsp page copy this code block:

<img src="${createLink(controller: 'simpleCaptcha', action: 'captcha')}"/><br/>

<input type="text" name="captcha"><br/>

<input type="submit" value="Register">

There will appear an image with capthca and the entered value will be passed as params.captcha.

In the controller that your <g:form> refers to put this code:

Outside of any action:

def simpleCaptchaService

In the controller:

boolean captchaValid = simpleCaptchaService.validateCaptcha(params.captcha)

if (captchaValid) {

   def user = new User(userName:params.userName)

   user.save()

   ...

} else {

   flash.message = "Wrong capthca"

   redirect(controller:"user", action:"login")

}

Now you will have a working captcha.

There also is a configuration closure that you can put into the Config.groovy

simpleCaptcha {

// font size used in CAPTCHA images

fontSize = 30

height = 200

width = 200

// number of characters in CAPTCHA text

length = 6

// amount of space between the bottom of the CAPTCHA text and the bottom of the CAPTCHA image

bottomPadding = 16

// distance between the diagonal lines used to obfuscate the text

lineSpacing = 10

// the charcters shown in the CAPTCHA text must be one of the following

chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"

// this param will be passed as the first argument to this java.awt.Font constructor

// http://docs.oracle.com/javase/6/docs/api/java/awt/Font.html#Font(java.lang.String,%20int,%20int)

font = "Serif"

}

Beginning Grails, Groovy and Griffon, error #1

Just found an error in the book. When you create a filter, the author suggests you to copy this code block to your app:

if (session?.user?.id != params?.id) {

flash.message = "You can only modify yourself!"

redirect(controller:"user", action: "index")

return false

}

But actually the params.id is a String and the session.user.id is a Long type, so this condition turns out to be executed every time, even when both values are 2, for example.

The working code would be like this:

if (session?.user?.id?.toInteger() != params?.id?.toInteger()) {

flash.message = "You can only modify yourself!"

redirect(controller:"user", action: "index")

return false

}

Look in to that determined glance. A being, determined to survive and do anything to survive. 

Lion is not trying to be a lion, the majestic king of nature, the ultimate predator it is. It simply is. It is his nature, and there is no other way that he can be.

To be a warrior.

There are no choices - to be the strongest predator, or not. He is, or he is not a lion. Or he is not alive. The only struggle that forces you to become something better - the struggle to survive.

A simpler way to encode passwords with grails

Hi! I've discovered that a password can be encrypted much easier, and without any additional plugins! Probably the encryption will not be so strong as with the jasypt plugin, but is much easier to implement.

The authentication method:

  def encryptedPassword = params.password.bytes.encodeBase64().toString()

def user = User.findByLoginAndPassword(params.login, encryptedPassword)

The register method:

def encryptedPassword = params.password.bytes.encodeBase64().toString()

def user = new User(login:params.login, password:encryptedPassword)

user.save()

All this encrypts the password at once when you enter it. Persists new user with the encrypted string to the DB, and when logging in it encrypts the entered password and then compares to the persisted string in your DB


Update: this is encoding, not encrypting:

Encoding transforms data into another format using a scheme that is publicly available so that it can easily be reversed.

Encryption transforms data into another format in such a way that only specific individual(s) can reverse the transformation.

Probably there are some uses for this stuff, but certainly not for security.

grails jasypt field encryption - encrypt database entries

Hi! One cool plugin i came across recently - jasypt-encryption plugin. Using it you can easily implement automatic encryption and decryption of fields to your database. This will protect data in your database. But not in your application, because in your app the data is unencrypted, it is encrypted only in the DB.

First of all, check this repository for a wiki and some code examples: https://github.com/dtanner/grails-jasypt

Installation is very easy:

1)In BuildConfig.groovy (for hibernate4 you need jasypt 1.3.1, for hibernate 3 you need jasypt 1.2.1):

plugins {

compile ":jasypt-encryption:1.3.1"

runtime ":hibernate4:4.3.5.5" 

}



2)in Config.groovy:


jasypt {

    algorithm = "PBEWITHSHA256AND256BITAES-CBC-BC"

    providerName = "BC"
    password = "test"
    keyObtentionIterations = 1000

}

3)And in the domain object you will use encryption, add import and mapping:

 import com.bloomhealthco.jasypt.GormEncryptedStringType
String password

static mapping = {

password type: GormEncryptedStringType
}

Not when the user is persisted, the password field is automatically encrypted, and decrypted when fetched from DB.

So, this is a way to add some security to your database. But if you need encryption for, example, protecting passwords, then you better not use jasypt, but use spring security.

Jasypt encrypts and persists data, and when you fetch data from the DB it is automatically decrypted, so, for example, in an authentication algorithm you compare unencrypted passwords, and the password fetched from DB exists in an unencrypted state in your application.

While with spring security plugin the encryption is one-way: the password is encrypted and persisted, and when user logins, the password is encrypted, and the encrypted string is compared to the persisted one from earlier.