Hi NB: we don't use Jira anymore, we are using GH Issues: https://github.com/apache/activemq/issues
I will take a look on your report. Thanks Regards JB On Tue, Oct 13, 2026 at 5:40 PM Paul Gale <[email protected]> wrote: > Hi all, > > I was unable to create a JIRA issue, so I am reporting this here. Could a > committer please open one if you agree it is a bug? > > *Affects:* 6.3.0, 6.3.1, 6.3.2, and main (webconsole). It was introduced in > 6.3.0; 6.2.x does not use jetty-webapps.xml. > > *Problem* > Since the Jetty 12 / EE11 migration (AMQ-9359), the web console no longer > sends the security headers added by AMQ-7265, AMQ-9545 and AMQ-9697, such > as X-Frame-Options, Content-Security-Policy and X-Content-Type-Options. The > rules are still defined, but they never run. > > *Steps to reproduce* (stock binary distribution, default config) > > 1. Unpack apache-activemq-6.3.1-bin.tar.gz and run bin/activemq start. > 2. curl -s -o /dev/null -D - -u <admin user>:<password> > http://127.0.0.1:8161/admin/ > > *Expected:* 200 with the headers defined in conf/jetty/jetty-webapps.xml. > *Actual:* 200 with none of them. > > *Cause* > conf/jetty/jetty-webapps.xml adds the header RewriteHandler to the Contexts > ContextHandlerCollection as a sibling of the /admin and /api > WebAppContexts, with no child handler. ContextHandlerCollection only routes > requests to handlers that contain a ContextHandler, so the RewriteHandler > is never on the request path for the webapps. When it is reached, it fails > with IllegalStateException: RewriteHandler: Child handler is not set. (HTTP > 500). > > *Suggested fix* > Insert the RewriteHandler into the Server's handler chain so that it wraps > Contexts, for example with Server.insertHandler(...), instead of adding it > to Contexts. Then add a test that asserts one of the headers on an > authenticated /admin/ response. > > Thanks, > > Paul >
