(cxf) branch 4.0.x-fixes updated: [CXF-9097]Camel 3|CXF|Tomcat: Request has been recycled

[ffang]

This is an automated email from the ASF dual-hosted git repository.

ffang pushed a commit to branch 4.0.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/4.0.x-fixes by this push:
     new 145de46ee5 [CXF-9097]Camel 3|CXF|Tomcat: Request has been recycled
145de46ee5 is described below

commit 145de46ee5ec011c3b1ecfb115970b75e772cca5
Author: Freeman Fang <freeman.f...@gmail.com>
AuthorDate: Thu Jan 16 13:04:52 2025 -0500

    [CXF-9097]Camel 3|CXF|Tomcat: Request has been recycled
    
    (cherry picked from commit d190dd1abec8ad86b88d6afe539152aa67f7ad43)
---
 .../cxf/transport/http/AbstractHTTPDestination.java      | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git 
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/AbstractHTTPDestination.java
 
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/AbstractHTTPDestination.java
index 376131af49..81262405d6 100644
--- 
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/AbstractHTTPDestination.java
+++ 
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/AbstractHTTPDestination.java
@@ -394,10 +394,22 @@ public abstract class AbstractHTTPDestination
 
         SecurityContext httpSecurityContext = new SecurityContext() {
             public Principal getUserPrincipal() {
-                return req.getUserPrincipal();
+                //ensure we use req from the one saved in inMessage
+                //as this could be the cachedInput one in oneway and 
+                //ReplyTo is specified when ws-addressing is used
+                //which means we need to switch thread context
+                //and underlying transport might discard any data on the 
original stream
+                HttpServletRequest reqFromInMessage = 
(HttpServletRequest)exchange.getInMessage().get(HTTP_REQUEST);
+                return reqFromInMessage.getUserPrincipal();
             }
             public boolean isUserInRole(String role) {
-                return req.isUserInRole(role);
+                //ensure we use req from the one saved in inMessage
+                //as this could be the cachedInput one in oneway and 
+                //ReplyTo is specified when ws-addressing is used
+                //which means we need to switch thread context
+                //and underlying transport might discard any data on the 
original stream
+                HttpServletRequest reqFromInMessage = 
(HttpServletRequest)exchange.getInMessage().get(HTTP_REQUEST);
+                return reqFromInMessage.isUserInRole(role);
             }
         };