HttpServletRequest.login() not creating cookies

[melloware]

Zulip: https://quarkusio.zulipchat.com/#narrow/channel/187038-dev/topic/j_security_check.20Programmatic.20Login.3F

Original Issue: melloware/quarkus-faces#409

Issue

If you do servletRequest.login(user, pass) no Quakrus Cookie is created when it should be.

Workaround

A hack workaround is to manually call /j_security_check, get the response, and if it contains the set-cookie header which is set by Quarkus, I also set that cookie in the original FacesContext Response. But I don't like this approach.

@Named
@RequestScoped
public class LoginController {

  String username;
  String password;

  @ConfigProperty(name = "quarkus.http.auth.form.cookie-name")
  String cookieName;

  @Inject
  FacesContext facesContext;

  public void login() {
    var request = (HttpServletRequest) facesContext.getExternalContext().getRequest();
    var securityCheckUrl = request.getRequestURL().toString()
          .replace("/login.xhtml", "/j_security_check");
    var response = HttpClient.newHttpClient().send(HttpRequest.newBuilder()
          .uri(URI.create(securityCheckUrl))
          .POST(HttpRequest.BodyPublishers.ofString(
              "j_username=" + username + "&j_password=" + password))
          .header("Content-Type", "application/x-www-form-urlencoded")
          .build(), HttpResponse.BodyHandlers.ofString());
    var fcResponse = (HttpServletResponse) facesContext.getExternalContext().getResponse();
    var responseMap = response.headers().map();
    if (responseMap.containsKey("set-cookie")) {
      var cookieString = responseMap.get("set-cookie").get(0);
      var quarkusCookie = new Cookie(cookieName, cookieString.split("=")[1]);
      quarkusCookie.setMaxAge(8 * 60 * 60);
      quarkusCookie.setHttpOnly(true);
      fcResponse.addCookie(quarkusCookie);
    }
    facesContext.getExternalContext().redirect("/mainPage.xhtml");
  }
}

Undertow Code

Here is the current Undertow code:

quarkus-http/servlet/src/main/java/io/undertow/servlet/spec/HttpServletRequestImpl.java

Lines 473 to 493 in 3ab7d0a

	@Override
	public void login(final String username, final String password) throws ServletException {
	if (username == null || password == null) {
	throw UndertowServletMessages.MESSAGES.loginFailed();
	}
	SecurityContext sc = exchange.getSecurityContext();
	if (sc.isAuthenticated()) {
	throw UndertowServletMessages.MESSAGES.userAlreadyLoggedIn();
	}
	boolean login = false;
	try {
	login = sc.login(username, password);
	} catch (SecurityException se) {
	if (se.getCause() instanceof ServletException)
	throw (ServletException) se.getCause();
	throw new ServletException(se);
	}
	if (!login) {
	throw UndertowServletMessages.MESSAGES.loginFailed();
	}
	}