[Red Hat JIRA] (WFWIP-370) JWT Cookie: wrong HTTP code with wrong cookie name
by Tommaso Borgato (Jira)
[ https://issues.redhat.com/browse/WFWIP-370?page=com.atlassian.jira.plugin... ]
Tommaso Borgato updated WFWIP-370:
----------------------------------
Description:
[MP JWT 1.2|https://issues.redhat.com/browse/EAP7-1596] introduces the option of sending the JWT as cookie;
When the application's {{microprofile-config.properties}} is configured as follows:
{noformat}
mp.jwt.token.header=Cookie
mp.jwt.token.cookie=jws-correct-cookie
{noformat}
And the request sends the JWT in a cookie named {{jws-wrong-cookie}}, we'd expect a 401 HTTP code, since authentication cannot happen;
Instead, the HTTP return code is 403 which means the request was authenticated but not authorized;
This is marked as minor because the access is denied in the end.
was:
[MP JWT 1.2|https://issues.redhat.com/browse/EAP7-1596] introduces the option of sending the JWT as cookie;
When the application's {{microprofile-config.properties}} is configured as follows:
{noformat}
mp.jwt.token.header=Cookie
mp.jwt.token.cookie=jws-correct-cookie
{noformat}
And the request sends the JWT in a cookie named {{jws-wrong-cookie}}, we'd expect a 401 HTTP code, since authentication cannot happen;
Instead, the HTTP return code is 403 which means the request was authenticated but not authorized;
> JWT Cookie: wrong HTTP code with wrong cookie name
> --------------------------------------------------
>
> Key: WFWIP-370
> URL: https://issues.redhat.com/browse/WFWIP-370
> Project: WildFly WIP
> Issue Type: Bug
> Components: MP JWT
> Reporter: Tommaso Borgato
> Assignee: Darran Lofthouse
> Priority: Minor
>
> [MP JWT 1.2|https://issues.redhat.com/browse/EAP7-1596] introduces the option of sending the JWT as cookie;
> When the application's {{microprofile-config.properties}} is configured as follows:
> {noformat}
> mp.jwt.token.header=Cookie
> mp.jwt.token.cookie=jws-correct-cookie
> {noformat}
> And the request sends the JWT in a cookie named {{jws-wrong-cookie}}, we'd expect a 401 HTTP code, since authentication cannot happen;
> Instead, the HTTP return code is 403 which means the request was authenticated but not authorized;
> This is marked as minor because the access is denied in the end.
--
This message was sent by Atlassian Jira
(v8.13.1#813001)
5 years, 2 months
[Red Hat JIRA] (WFWIP-370) JWT Cookie: wrong HTTP code with wrong cookie name
by Tommaso Borgato (Jira)
Tommaso Borgato created WFWIP-370:
-------------------------------------
Summary: JWT Cookie: wrong HTTP code with wrong cookie name
Key: WFWIP-370
URL: https://issues.redhat.com/browse/WFWIP-370
Project: WildFly WIP
Issue Type: Bug
Components: MP JWT
Reporter: Tommaso Borgato
Assignee: Darran Lofthouse
[MP JWT 1.2|https://issues.redhat.com/browse/EAP7-1596] introduces the option of sending the JWT as cookie;
When the application's {{microprofile-config.properties}} is configured as follows:
{noformat}
mp.jwt.token.header=Cookie
mp.jwt.token.cookie=jws-correct-cookie
{noformat}
And the request sends the JWT in a cookie named {{jws-wrong-cookie}}, we'd expect a 401 HTTP code, since authentication cannot happen;
Instead, the HTTP return code is 403 which means the request was authenticated but not authorized;
--
This message was sent by Atlassian Jira
(v8.13.1#813001)
5 years, 2 months
[Red Hat JIRA] (WFLY-14394) WildFly does not start when async-registration attribute in XTS subsystem is set to an expression
by Petr Adamec (Jira)
Petr Adamec created WFLY-14394:
----------------------------------
Summary: WildFly does not start when async-registration attribute in XTS subsystem is set to an expression
Key: WFLY-14394
URL: https://issues.redhat.com/browse/WFLY-14394
Project: WildFly
Issue Type: Bug
Components: XTS
Affects Versions: 22.0.0.Final
Reporter: Petr Adamec
Assignee: Ondrej Chaloupka
XTS subsystem supports expression for async-registration as described in the description:
{code:java}
/subsystem=xts:read-resource-description
...
"attributes" => {
"async-registration" => {
"type" => BOOLEAN,
"description" => "Initialize endpoints for asynchronous registration needed for WS-AT .NET integration.",
"expressions-allowed" => true,
"required" => false,
"nillable" => true,
"default" => false,
"access-type" => "read-write",
"storage" => "configuration",
"restart-required" => "all-services"
},
{code}
However if I set the attribute to an expression, the server fails to reload:
{code:java}
12:17:26,482 ERROR [org.jboss.as.controller] (Controller Boot Thread)
OPVDX001: Validation error in standalone-xts.xml -------------------------------
|
| 670: <xts-environment url="http://${jboss.bind.address:127.0.0.1}:8080/ws-c11/ActivationService"/>
| 671: <default-context-propagation enabled="true"/>
| 672: <async-registration enabled="${env.var:false}"/>
| ^^^^ '${env.var:false}' isn't a valid value for the 'enabled' attribute
|
| 673: </subsystem>
| 674: </profile>
| 675: <interfaces>
|
| The primary underlying error message was:
| > ParseError at [row,col]:[672,13]
| > Message: WFLYCTL0106: Invalid value '${env.var:false}' for attribute
| > 'enabled'
|
|-------------------------------------------------------------------------------
12:17:26,483 ERROR [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0055: Caught exception during boot: org.jboss.as.controller.persistence.ConfigurationPersistenceException: WFLYCTL0085: Failed to parse configuration
at org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:143)
at org.jboss.as.server.ServerService.boot(ServerService.java:395)
at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:416)
at java.lang.Thread.run(Thread.java:748)
12:17:26,484 FATAL [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0056: Server boot has failed in an unrecoverable manner; exiting. See previous messages for details.
{code}
The subsystem is deprecated hence priority is major.
{code:java}
"result" => {
"description" => "The configuration of the XST subsystem.",
"deprecated" => {
"since" => "3.0.0",
"reason" => "Deprecated since the XTS feature set is rarely used and is considered legacy within development approaches nowadays."
},
{code}
--
This message was sent by Atlassian Jira
(v8.13.1#813001)
5 years, 2 months