dashorst opened a new issue, #1661:
URL: https://github.com/apache/wicket/issues/1661
`CrossOriginOpenerPolicyRequestCycleListener` and
`CrossOriginEmbedderPolicyRequestCycleListener` decide whether a request is
exempted from the header with
```java
String path = request.getContextPath();
if (coopConfig.getExemptions().contains(path))
```
`getContextPath()` is the context path of the web application, the same for
every request (often `""`), not the path of the requested page. A path added
with `addExemptedPath("/some/page")` therefore never matches, and the header is
sent on every page. Only exempting the context path itself has an effect, and
then it exempts the whole application.
The tests do not catch this: `testCoopHeadersNotSetExemptedPath` and
`testCoepHeadersNotSetExemptedPath` run with `CoopMode.DISABLED` /
`CoepMode.DISABLED`, where no header is sent at all, so they pass whether or
not the exemption works.
Proposed fix: compare the exemptions with the request path inside the
application (for example the servlet path plus path info, or the Wicket request
URL), test an exemption with the policy enabled, and document in
`addExemptedPath` which form of path is expected. Same code on master and
wicket-10.x.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
