Hi all, I was unable to create a JIRA issue, so I am reporting this here. Could a committer please open one if you agree it is a bug?
*Affects:* 6.3.0, 6.3.1, 6.3.2, and main (webconsole). It was introduced in 6.3.0; 6.2.x does not use jetty-webapps.xml. *Problem* Since the Jetty 12 / EE11 migration (AMQ-9359), the web console no longer sends the security headers added by AMQ-7265, AMQ-9545 and AMQ-9697, such as X-Frame-Options, Content-Security-Policy and X-Content-Type-Options. The rules are still defined, but they never run. *Steps to reproduce* (stock binary distribution, default config) 1. Unpack apache-activemq-6.3.1-bin.tar.gz and run bin/activemq start. 2. curl -s -o /dev/null -D - -u <admin user>:<password> http://127.0.0.1:8161/admin/ *Expected:* 200 with the headers defined in conf/jetty/jetty-webapps.xml. *Actual:* 200 with none of them. *Cause* conf/jetty/jetty-webapps.xml adds the header RewriteHandler to the Contexts ContextHandlerCollection as a sibling of the /admin and /api WebAppContexts, with no child handler. ContextHandlerCollection only routes requests to handlers that contain a ContextHandler, so the RewriteHandler is never on the request path for the webapps. When it is reached, it fails with IllegalStateException: RewriteHandler: Child handler is not set. (HTTP 500). *Suggested fix* Insert the RewriteHandler into the Server's handler chain so that it wraps Contexts, for example with Server.insertHandler(...), instead of adding it to Contexts. Then add a test that asserts one of the headers on an authenticated /admin/ response. Thanks, Paul
