title: Restrict access to java-melody monitoring url
body: <p>Is there a way I can restrict access to /monitoring url generated by Java-Melody plugin in Grails using Shiro roles?</p>
  
  <p><strong>Update:</strong> a little bit more details. It's no problem so secure most Grails ressources with shiro. But in case of the java melody plugin, it seems that the melody filter is executed before the shiro filter gets  executed. This renders shiro useless.</p>
  
  <p>There are some solutions which say that this might be fixed through a change in the web.xml, but this is not a quick hit and I (rdmueller) didn't manage to make it work yet. The web.xml plugin also seems to promise some help, but I don't want to add another plugin just to secure one plugin.</p>
  
  <p>Some older statements found on the web state that this problem should be already solved through the usage of the <code>loadAfter</code> list in this file: <a href="https://github.com/javamelody/grails-melody-plugin/blob/master/GrailsMelodyGrailsPlugin.groovy">https://github.com/javamelody/grails-melody-plugin/blob/master/GrailsMelodyGrailsPlugin.groovy</a> - but it seems that this only worked for older versions of Grails.</p>
  
  <p><strong>Update2:</strong> In order to make it easier to propose a solution, I've create a Grails 2.2.4 sample: <a href="https://github.com/rdmueller/SO30739581">https://github.com/rdmueller/SO30739581</a></p>
  
  <p>just clone the project, do a <code>grailsw run-app</code> and navigate to</p>
  
  <pre><code>http://localhost:8080/SO30739581/dbdoc
  </code></pre>
  
  <p>and you'll get a login screen via shiro. Navigate to</p>
  
  <pre><code>http://localhost:8080/SO30739581/monitoring
  </code></pre>
  
  <p>and you'll get the melody screen without being logged in :-(</p>