[security-dev] SPFilter should check principal in POST calls

Claudio Miranda claudio at claudius.com.br
Wed Oct 29 14:00:59 EDT 2014

On Thu, Oct 23, 2014 at 5:19 PM, Pedro Igor Silva <psilva at redhat.com> wrote:
> However, the SPFilter is pretty outdated if you compare with both JBossWeb/Tomcat valves and Undertow mech. Maybe you can reach a blocker in the future ...
>     Please, send your contribution if you like to. Contribution is always welcome :)

Hi Pedro, I saw that only GET is allowed because every POST is
redirected to IDP in case a saml response is part of the POST request.
So, my modification just checks if there are a post response. I tried
to test in wildfly 9 recent snapshop, but it throws a NPE in
The tests are performed with jboss-picketlink-quickstarts (idp,
sales-post, employee)


Also a minor fix, to correct a wrong wildfly name in
picketlink-wildfly-common artifact name


  Claudio Miranda

claudio at claudius.com.br

More information about the security-dev mailing list