Can not add the security headers on WebLogic 12c #5945
Comments
|
This sounds everything is working as expected. The AntPathRequestMatcher uses the servletPath + pathInfo intentionally because otherwise there is no way for it to distinguish between two different servlets with the same path. For example, if you could create two servlets /spring and /struts and then have a mapping internally that is /foo/bar. If AntPathRequestMatcher ignored the servlet path there would be no way to distinguish between /spring/foo/bar and /struts/foo/bar. To fix the issue, include the servlet mapping in the AntPathRequestMatcher constructor. |
|
Closing as this sounds it is expected behavior and I provided the correction to the configuration. If you are still having problems, please reopen this issue |
|
@rwinch Thanks for the response and I have a bit question. I executed the same application which have only one servlet "/" with above configuration on Tomcat 8.5 and WebLogic 12c. Is that a expected design? |
|
I'm confused what is happening. The HeaderWriterFilter will not be executed on forwards because it is a OncePerRequestFilter. So it should only be checking for the original request and not the forwarded URL. |
|
@rwinch Sorry for my poor English. Yes, the Because servlet response will be flush or close when forwarding by the Stacktrace on Tomcat as follows: Stacktrace on WebLogic as follows: At this timing, the Is this a problem of the servlet container implementation or Spring Security implementation or my configuration? (Sorry, I have no permission to reopen the issue.) |
|
The request should not be modified when forwarding happens so the URL should stay the same. It sounds like a container issue to me. Can you put together a sample and instructions on how to run it in WebLogic (I haven't used WebLogic much) so I can take a look? With lots of things to do on my end, the easier you can make it for me, the faster I can take a look at this. |
|
@rwinch Thanks for co-operation! I pushed sample app : Please install WebLogic and deploy it.
Best regards. |
|
I download and ran "Quick Installer intended for Oracle WebLogic Server and Oracle Coherence development only." and it did not have a file named Any suggestions? Below are the first three levels of the directory structure (if I do the entire thing it is pretty enormous). |
|
Also here are the files that start with start and end with .sh |
|
@rwinch Please install with this reference. |
|
Thanks for the additional details. Spring Security is indeed behaving as expected. Weblogic is changing the values of the HttpServletRequest after the forward which should not happen. When HeaderWriterResponse is created in HeaderWriterFilter the request matches This is a bug in Weblogic implementation. You could work around it by either changing the AntPathRequestMatcher to match on the forward URL. Alternatively you can create a custom Filter that sets a request attribute with the original URL and then a custom RequestMatcher that matches on that attribute rather than the path. |
|
I think it's better to announce in the Spring Security Reference to be aware that "When using a JSP on a specific web application server, we need to specify the path of the JSP to forward rather than the request path". Thanks. |
|
This is not necessary for most containers (as you pointed out it works in Tomcat). This is something that is broken in Weblogic and only a workaround. |
rwinch
added
the
status: declined
Summary
We can not add the security headers (e.g. Cache-Controll) via the
DelegatingRequestMatcherHeaderWriterwith theAntPathRequestMatcheron WebLogic 12c.The
AntPathRequestMatcheruse theHttpServletRequest#getServletPathto match the path, and that method return the JSP's path (forwarded by theJstlView) at theHeaderWriterResponse#writeHeaders.Actual Behavior
@RequestMapping(value = "/foo/bar")invoked, and return the view name "welcome/home". (prefixis "/WEB-INF/views/" andsuffixis ".jsp")JstlViewforward to "/WEB-INF/views/welcome/home.jsp".HeaderWriterResponse#onResponseCommittedis called and theDelegatingRequestMatcherHeaderWriteris invoked, but theAntPathRequestMatcher, that configured with the path "/foo/bar/**", said the path is not match because servlet path pointed to JSP, and not invoked theHeaderWriter.For that reason, we can not add the security headers to the response on the WebLogic servler.
Expected Behavior
Spring Security should be able to add the security headers to the response via the
DelegatingRequestMatcherHeaderWriterwith theAntPathRequestMatcheron any servlet container implementation.Configuration
Version
Spring Security 5.0.7.RELEASE
Spring IO Platform Cairo-SR3
WebLogic 12.2.1.2.0
The text was updated successfully, but these errors were encountered: