This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git
The following commit(s) were added to refs/heads/main by this push:
new 30760bca47 properly handle pooled threads
30760bca47 is described below
commit 30760bca4705921c80635cca0561086596a3ff7d
Author: Markus Jung <[email protected]>
AuthorDate: Sat Aug 29 20:57:05 2026 +0200
properly handle pooled threads
---
.../openejb/server/httpd/OpenEJBHttpServer.java | 7 ++
.../server/httpd/OpenEJBHttpServerTest.java | 91 ++++++++++++++++++++++
2 files changed, 98 insertions(+)
diff --git
a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/OpenEJBHttpServer.java
b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/OpenEJBHttpServer.java
index 6aa282dcd9..4f83cc4a97 100644
---
a/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/OpenEJBHttpServer.java
+++
b/server/openejb-http/src/main/java/org/apache/openejb/server/httpd/OpenEJBHttpServer.java
@@ -25,6 +25,7 @@ import org.apache.openejb.server.context.RequestInfos;
import org.apache.openejb.server.httpd.session.SessionManager;
import org.apache.openejb.server.stream.CountingInputStream;
import org.apache.openejb.server.stream.CountingOutputStream;
+import org.apache.openejb.spi.SecurityService;
import org.apache.openejb.util.LogCategory;
import org.apache.openejb.util.Logger;
import org.apache.openejb.util.OptionsLog;
@@ -298,6 +299,12 @@ public class OpenEJBHttpServer implements HttpServer {
listener.onMessage(req, res);
} catch (Throwable t) {
throw new OpenEJBException("Error occurred while executing the
module " + location + "\n" + t.getClass().getName() + ":\n" + t.getMessage(),
t);
+ } finally {
+ // the request thread is pooled, reset any security association
made during the request
+ final SecurityService securityService =
SystemInstance.get().getComponent(SecurityService.class);
+ if (securityService != null) {
+ securityService.disassociate();
+ }
}
final boolean async = "true".equals(req.getAttribute("openejb_async"));
diff --git
a/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/OpenEJBHttpServerTest.java
b/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/OpenEJBHttpServerTest.java
new file mode 100644
index 0000000000..959ff518d8
--- /dev/null
+++
b/server/openejb-http/src/test/java/org/apache/openejb/server/httpd/OpenEJBHttpServerTest.java
@@ -0,0 +1,91 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.openejb.server.httpd;
+
+import org.apache.openejb.jee.EjbJar;
+import org.apache.openejb.junit.ApplicationComposer;
+import org.apache.openejb.loader.SystemInstance;
+import org.apache.openejb.spi.SecurityService;
+import org.apache.openejb.testing.Configuration;
+import org.apache.openejb.testing.EnableServices;
+import org.apache.openejb.testing.Module;
+import org.apache.openejb.testng.PropertiesBuilder;
+import org.apache.openejb.util.NetworkUtil;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.security.Principal;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Properties;
+import java.util.concurrent.CopyOnWriteArrayList;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+
+@EnableServices({"httpejbd"})
+@RunWith(ApplicationComposer.class)
+public class OpenEJBHttpServerTest {
+ private int nextAvailablePort = -1;
+
+ @Test
+ public void requestStartsWithoutCallerIdentity() throws Exception {
+ final List<String> callersAtRequestStart = new
CopyOnWriteArrayList<>();
+ final HttpListenerRegistry registry =
SystemInstance.get().getComponent(HttpListenerRegistry.class);
+ registry.addHttpListener(new HttpListener() {
+ @Override
+ public void onMessage(final HttpRequest request, final
HttpResponse response) throws Exception {
+ final Principal principal =
SystemInstance.get().getComponent(SecurityService.class).getCallerPrincipal();
+ callersAtRequestStart.add(principal == null ? null :
principal.getName());
+ request.login("jonathan", "secret"); // intentionally never
logged out
+ response.getOutputStream().write("ok".getBytes());
+ }
+ }, "/login");
+ try {
+ final List<Integer> statuses = new ArrayList<>();
+ for (int i = 0; i < 10; i++) {
+ final URL url = new URL("http://localhost:"; +
nextAvailablePort + "/login");
+ final HttpURLConnection connection =
HttpURLConnection.class.cast(url.openConnection());
+ statuses.add(connection.getResponseCode());
+ connection.disconnect();
+ }
+ assertEquals(10, callersAtRequestStart.size());
+ assertFalse(callersAtRequestStart.toString(),
callersAtRequestStart.contains("jonathan"));
+ assertEquals(Collections.nCopies(10, 200), statuses);
+ } finally {
+ registry.removeHttpListener("/login");
+ }
+ }
+
+ @Configuration
+ public Properties props() {
+ nextAvailablePort = NetworkUtil.getNextAvailablePort();
+ return new PropertiesBuilder()
+ .p("httpejbd.port", Integer.toString(nextAvailablePort))
+ .p("httpejbd.threadsCore", "2")
+ .p("httpejbd.threads", "2")
+ .build();
+ }
+
+ @Module
+ public EjbJar jar() {
+ return new EjbJar();
+ }
+}
