[
https://issues.apache.org/jira/browse/TOMEE-4729?focusedWorklogId=1046552&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1046552
]
ASF GitHub Bot logged work on TOMEE-4729:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 09/Oct/26 09:14
Start Date: 09/Oct/26 09:14
Worklog Time Spent: 10m
Work Description: rzo1 opened a new pull request, #3080:
URL: https://github.com/apache/tomee/pull/3080
When a request went async and the token was validated lazily after
MPJWTFilter returned, the caller identity and run-as state stayed on the
container thread. The state is now restored when the async request completes,
errors or times out, and only on the thread that set it. Synchronous requests
are unchanged. Fixes TOMEE-4729.
Issue Time Tracking
-------------------
Worklog Id: (was: 1046552)
Remaining Estimate: 0h
Time Spent: 10m
> MP-JWT security state is not restored for asynchronous requests
> ---------------------------------------------------------------
>
> Key: TOMEE-4729
> URL: https://issues.apache.org/jira/browse/TOMEE-4729
> Project: TomEE
> Issue Type: Bug
> Reporter: Richard Zowalla
> Assignee: Richard Zowalla
> Priority: Major
> Fix For: 11.0.0, 10.3.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> If a request starts asynchronous processing and the bearer token is first
> validated after MPJWTFilter.doFilter has returned \(lazy validation through
> MPJWTServletRequestWrapper\), TomcatSecurityService.enterWebApp pushes the
> caller identity and run\-as subject onto the container thread that runs the
> async work. Nothing calls exitWebApp for it, because the filter's cleanup has
> already run without a saved MP\_JWT\_PRE\_LOGIN\_STATE, so the state can
> remain on a pooled thread \(see the existing TODO in MPJWTFilter about async
> requests\). The state should be restored when the async work completes,
> errors or times out.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
