JASPIC authentication processed on unsecured ressources ------------------------------------------------------- Key: WFLY-4618 URL: https://issues.jboss.org/browse/WFLY-4618 Project: WildFly Issue Type: Bug Components: Security, Web (JBoss Web), Web (Undertow) Affects Versions: 8.2.0.Final, 9.0.0.CR1 Reporter: Gernot Müller Assignee: Stuart Douglas When using JASPIC authentication in web-projects, then serving unsecured resources (like unsecured pages, css/js-resources) ends in calling configured JASPI auth-modules. The problem is located in class JASPIAuthenticationMechanism (Undertow extension) where SecurityContext is never asked if the request has to be authenticated. So JASPIC can't be used wor web-applications which consist of secured AND unsecured parts.