Richard Zowalla created TOMEE-4729:
--------------------------------------
Summary: MP-JWT security state is not restored for asynchronous
requests
Key: TOMEE-4729
URL: https://issues.apache.org/jira/browse/TOMEE-4729
Project: TomEE
Issue Type: Bug
Reporter: Richard Zowalla
Assignee: Richard Zowalla
Fix For: 11.0.0, 10.3.0
If a request starts asynchronous processing and the bearer token is first
validated after MPJWTFilter.doFilter has returned \(lazy validation through
MPJWTServletRequestWrapper\), TomcatSecurityService.enterWebApp pushes the
caller identity and run\-as subject onto the container thread that runs the
async work. Nothing calls exitWebApp for it, because the filter's cleanup has
already run without a saved MP\_JWT\_PRE\_LOGIN\_STATE, so the state can remain
on a pooled thread \(see the existing TODO in MPJWTFilter about async
requests\). The state should be restored when the async work completes, errors
or times out.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
