joseluisll opened a new pull request, #8946: URL: https://github.com/apache/hadoop/pull/8946
### Description of PR AuthenticationFilter, RestCsrfPreventionFilter and KMSAuthenticationFilter refuse a request with a message the caller acts on. That message travels in the reason phrase and in the error page sendError writes, but Jetty writes that page for GET, POST and HEAD only. A refusal of a PUT or a DELETE has nothing but the phrase, which HTTP/2 does not have and later Jetty releases do not send. The filters now mark their refusals with the new request attribute AuthenticationFilter.ERROR_MESSAGE_FOR_ANY_METHOD_ATTRIBUTE. HttpServer2 installs ReasonBodyErrorHandler on its webapp, /logs and /static contexts, which writes the error page for a marked error whatever the method. It extends ErrorPageErrorHandler, so web.xml <error-page> mappings keep working, and unmarked errors get the answer they get today. The CSRF and KMS filters replace the cast to Jetty's Response and setStatusWithReason with the Servlet API's setStatus(int, String), which Jetty 9.4 sends as the phrase. It also reaches the container through a response wrapper, where the cast did not. AuthenticationFilter already called it. TestRestCsrfPreventionFilter checks the phrase and the marker. TestHttpServer checks that a marked PUT or DELETE error has a body and an unmarked one does not. ### How was this patch tested? The changed modules' tests, run by the Yetus precommit and the fork's CI on this branch. ### For code changes: - [x] Does the title of this PR start with the corresponding JIRA issue id? - [ ] Object storage: not applicable, no object store integration touched. - [ ] If adding new dependencies to the code: not applicable, no new dependency. - [ ] If applicable, have you updated the LICENSE files: not applicable. ### AI Tooling If an AI tool was used: - [x] The PR includes the phrase "Contains content generated by <tool>" where <tool> is the name of the AI tool used. - [x] My use of AI contributions follows the ASF legal policy https://www.apache.org/legal/generative-tooling.html Contains content generated by Claude Code. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
