Spring Security method security authentication failure produces 500 response when using Jersey #12995
Comments
spring-projects-issues
added
the
status: waiting-for-triage
|
The response is already committed due to an earlier call to The call's being made as a result of Jersey catching Spring Security's Jersey then throws a This is caught by Spring Security's As far as I can tell, there's nothing wrong with the application's configuration and this appears to be a bug in Spring Security. /cc @rwinch @jgrandja @andreysaksonov Unfortunately, GitHub doesn't let us move issues from one repository to another. Can you please open a Spring Security issue, referencing this one? |
wilkinsona
added
status: invalid
|
I've raised spring-projects/spring-security#5273 |
Turns out that I was wrong here. While there was a problem with Spring Security assuming it could send an error, there was also a problem with how Jersey was configured. Jersey provides a configuration property, diff --git a/src/main/java/com/example/demo12995/Demo12995Application.java b/src/main/java/com/example/demo12995/Demo12995Application.java
index 1b69bca..6894363 100644
--- a/src/main/java/com/example/demo12995/Demo12995Application.java
+++ b/src/main/java/com/example/demo12995/Demo12995Application.java
@@ -12,6 +12,8 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
+import java.util.Collections;
+
import javax.ws.rs.Path;
@SpringBootApplication
@@ -20,7 +22,9 @@ public class Demo12995Application {
@Bean
public ResourceConfig jerseyResourceConfig() {
- return new ResourceConfig();
+ ResourceConfig resourceConfig = new ResourceConfig();
+ resourceConfig.setProperties(Collections.singletonMap("jersey.config.server.response.setStatusOverSendError", true));
+ return resourceConfig;
}
@BeanI'm going to re-open this issue as I think there's room for improvement in Boot. At the least, I think we should document the need to set the property when using Spring Security and method security. It would also be interesting to explore whether or not we can set the property automatically somehow. I thought it would be picked up when set using |
wilkinsona
changed the title
wilkinsona
added
type: documentation
wilkinsona
removed
the
for: team-attention
|
@wilkinsona, I was tricked by the fact that init parameters are not applied if you create ResourceConfig explicitly in Jersey (and in case of spring boot this is always the case). i think in case of creating @OnMissingBean default ResourceConfig all init parameters must be set to mimic jersey spec |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Demo project which demostrates an issue: https://github.com/andreysaksonov/demo-12995/archive/master.zip
Basically, if you try use GlobalMethodSecurity on Jersey resources you will face exception below:
Whats wrong with such configuration?
The text was updated successfully, but these errors were encountered: