[SHIRO-579] Permission filter is validating last matched path

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.3.0
• Fix Version/s: 1.4.0
• Component/s: Integration: Guice
• Environment: Google App Engine
• Assignee: Jared Bunting
• Reporter: Kusmanjali
• Created: 11/Aug/16 19:57
• Updated: 15/Dec/16 17:43
• Resolved: 15/Dec/16 17:43

Description

Following filter chain is present in configureShiroWeb() function

addFilterChain("/*/first/second/*", AUTHC_BASIC, config(PERMS, "X:create"));
addFilterChain("/*/first/*", AUTHC_BASIC, config(PERMS, "Y:create"));

for a URL : example.appspot.com/_ah/api/hello/v1/first/second/third the access is granted for a user with permission Y:create and not with X:create.

Issue Links

• relates to: SHIRO-605 ShiroWebModule creates out of order filter chain.