| Summary: | HttpServletRequest.login() always throws ServletException after invoking HttpServletRequest.isUserInRole() | ||
|---|---|---|---|
| Product: | [RT] Jetty | Reporter: | michael1224.fang |
| Component: | server | Assignee: | Greg Wilkins <gregw> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | major | ||
| Priority: | P3 | CC: | jetty-inbox |
| Version: | 8.0.0 | ||
| Target Milestone: | 7.2.x | ||
| Hardware: | PC | ||
| OS: | Windows XP | ||
| Whiteboard: | |||
The issue appears to be caused by calls like isUserInRole forcing the authentication to be changed from deferred to unauthenticated. A simple change will be to make Deferred.authenticate(...) return this if authentication fails. But I'm concerned than unauthenticated might be set other ways and thus using it as a tunnel to the login service may not be the best idea. tentative fix in r3109 |
Build Identifier: HttpServletRequest.login() always throws ServletException after invoking HttpServletRequest.isUserInRole(). The issue could be reproduced by the following code snippet: public class LoginServlet extends javax.servlet.http.HttpServlet { protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { if (!request.isUserInRole("user")) { try { request.login("user", "password"); } catch(ServletException se) { // ServletException is always thrown here } } } } Reproducible: Always