[JBoss JIRA] (ELY-1985) (7.3.z) Elytron needs to deal with JEPS 244 in the org.wildfly.security.ssl package
by Ilia Vassilev (Jira)
Ilia Vassilev created ELY-1985:
----------------------------------
Summary: (7.3.z) Elytron needs to deal with JEPS 244 in the org.wildfly.security.ssl package
Key: ELY-1985
URL: https://issues.redhat.com/browse/ELY-1985
Project: WildFly Elytron
Issue Type: Bug
Components: SSL
Affects Versions: 1.12.0.Final
Reporter: Ilia Vassilev
Assignee: Darran Lofthouse
Fix For: 1.12.1.Final
JEPS 244, available in JDK 9 or later and in JDK 8 since the 251 release[1] has added new methods to some of the javax.net.ssl classes that elytron wraps in org.wildfly.security.ssl. But the elytron classes do not handle those new methods. I believe the relevant change is at [2] and updates the SSLEngine, SSLParameters and SSLSocket classes (plus various non-javax classes.)
If Elytron were to require 251 or later to build perhaps this could be a simple matter of adding new methods to the wrappers and calling the delegate, under the expectation that at runtime the wrapper methods would not be invoked in a JVM < 251. Or the wrappers could use reflection and throw a UOE if the methods are not available.
[1] https://www.oracle.com/technetwork/java/javase/8u251-relnotes-5972664.htm...
[2] https://hg.openjdk.java.net/jdk8u/jdk8u41/jdk/rev/b26b096d4c89
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
4 years, 7 months
[JBoss JIRA] (WFLY-13559) Header response has changed and missing fields
by Brian Stansberry (Jira)
[ https://issues.redhat.com/browse/WFLY-13559?page=com.atlassian.jira.plugi... ]
Brian Stansberry commented on WFLY-13559:
-----------------------------------------
[~alex.ciouca] I suggest asking on https://groups.google.com/forum/#!forum/wildfly. I'll leave this open for a bit in case conversation there reveals a bug, but at the moment this is more a request for community help which is better handled via the forums.
> Header response has changed and missing fields
> ----------------------------------------------
>
> Key: WFLY-13559
> URL: https://issues.redhat.com/browse/WFLY-13559
> Project: WildFly
> Issue Type: Bug
> Affects Versions: 19.1.0.Final
> Reporter: Alexandru Ciouca
> Priority: Major
> Attachments: standalone_18.0.0.final.xml, standalone_19.1.0.final.xml
>
>
> I have an application running in WildFly with some open endpoints to call and I tried an upgrade to WildFly 19.1.0.final from 18.0.0.final, but I noticed that something changed when calling the endpoints. In the Response Header I see that some of the fields are changed or are missing. Is this supposed to happen or do I need to add some extra configuration with WildFly 19?
> Response WildFly 18.0.0.final:
> {code}
> HTTP/2 500
> cache-control: no-store, no-cache, must-revalidate
> set-cookie: JSESSIONID=pLpPEvZZVekh0Bkqq06muz_cJ4_fmwxsqrt0HUdP.myservices-container-6f5b87f79d-ngzhf; path=/myservices
> access-control-allow-headers: origin, content-type, accept, X-XSRF-TOKEN
> content-type: application/json
> content-length: 182
> link: <http://test.com/afs/rest>; rel="profile"
> date: Thu, 04 Jun 2020 07:34:10 GMT
> set-cookie: 7951a12696148c7a83e36db56eeb5f91=5ede0885e2c831c4946125e91d3facba; path=/; HttpOnly; Secure
> strict-transport-security: max-age=31536000; includeSubdomains
> x-xss-protection: 1; mode=block
> x-content-type-options: nosniff
> x-frame-options: SAMEORIGIN
> {code}
> Response WildFly 19.1.0.final:
> {code}
> HTTP/2 200
> set-cookie: JSESSIONID=9siDVU14OoFXojIIVxlMWbxNg1gcuSmLokwamY29.myservices-container-7c8dbf55f5-ctcks; path=/myservices
> content-type: application/json
> content-length: 182
> date: Thu, 04 Jun 2020 07:27:57 GMT
> set-cookie: 7951a12696148c7a83e36db56eeb5f91=3edfc7a7549d107b41669532f6cb594a; path=/; HttpOnly; Secure
> cache-control: private
> strict-transport-security: max-age=31536000; includeSubdomains
> x-xss-protection: 1; mode=block
> x-content-type-options: nosniff
> x-frame-options: SAMEORIGIN
> {code}
> As you can see the first thing that changed is the response code, even though the code is the same for both versions. The cache-control is also different and access-control-allow-headers and link fields are missing.
> I am attaching also the standalone.xml for both versions.
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
4 years, 7 months
[JBoss JIRA] (WFLY-13559) Header response has changed and missing fields
by Brian Stansberry (Jira)
[ https://issues.redhat.com/browse/WFLY-13559?page=com.atlassian.jira.plugi... ]
Brian Stansberry reassigned WFLY-13559:
---------------------------------------
Assignee: (was: Brian Stansberry)
> Header response has changed and missing fields
> ----------------------------------------------
>
> Key: WFLY-13559
> URL: https://issues.redhat.com/browse/WFLY-13559
> Project: WildFly
> Issue Type: Bug
> Affects Versions: 19.1.0.Final
> Reporter: Alexandru Ciouca
> Priority: Major
> Attachments: standalone_18.0.0.final.xml, standalone_19.1.0.final.xml
>
>
> I have an application running in WildFly with some open endpoints to call and I tried an upgrade to WildFly 19.1.0.final from 18.0.0.final, but I noticed that something changed when calling the endpoints. In the Response Header I see that some of the fields are changed or are missing. Is this supposed to happen or do I need to add some extra configuration with WildFly 19?
> Response WildFly 18.0.0.final:
> {code}
> HTTP/2 500
> cache-control: no-store, no-cache, must-revalidate
> set-cookie: JSESSIONID=pLpPEvZZVekh0Bkqq06muz_cJ4_fmwxsqrt0HUdP.myservices-container-6f5b87f79d-ngzhf; path=/myservices
> access-control-allow-headers: origin, content-type, accept, X-XSRF-TOKEN
> content-type: application/json
> content-length: 182
> link: <http://test.com/afs/rest>; rel="profile"
> date: Thu, 04 Jun 2020 07:34:10 GMT
> set-cookie: 7951a12696148c7a83e36db56eeb5f91=5ede0885e2c831c4946125e91d3facba; path=/; HttpOnly; Secure
> strict-transport-security: max-age=31536000; includeSubdomains
> x-xss-protection: 1; mode=block
> x-content-type-options: nosniff
> x-frame-options: SAMEORIGIN
> {code}
> Response WildFly 19.1.0.final:
> {code}
> HTTP/2 200
> set-cookie: JSESSIONID=9siDVU14OoFXojIIVxlMWbxNg1gcuSmLokwamY29.myservices-container-7c8dbf55f5-ctcks; path=/myservices
> content-type: application/json
> content-length: 182
> date: Thu, 04 Jun 2020 07:27:57 GMT
> set-cookie: 7951a12696148c7a83e36db56eeb5f91=3edfc7a7549d107b41669532f6cb594a; path=/; HttpOnly; Secure
> cache-control: private
> strict-transport-security: max-age=31536000; includeSubdomains
> x-xss-protection: 1; mode=block
> x-content-type-options: nosniff
> x-frame-options: SAMEORIGIN
> {code}
> As you can see the first thing that changed is the response code, even though the code is the same for both versions. The cache-control is also different and access-control-allow-headers and link fields are missing.
> I am attaching also the standalone.xml for both versions.
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
4 years, 7 months