This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch tomee-10.x in repository https://gitbox.apache.org/repos/asf/tomee.git
commit b8a0aa613ee1d1f64e28b2ceb0b36830b5b92233 Author: Richard Zowalla <[email protected]> AuthorDate: Tue Oct 13 08:46:58 2026 +0200 Register the MP-JWT filter only for the MP-JWT auth method (#3067) Other @LoginConfig auth methods such as BASIC or FORM must not enable JWT authentication. (cherry picked from commit 1f73e92c051cc1bd7982acfe1c5825c3820c0553) --- .../tomee/microprofile/jwt/MPJWTInitializer.java | 2 +- .../microprofile/jwt/MPJWTInitializerTest.java | 84 ++++++++++++++++++++++ 2 files changed, 85 insertions(+), 1 deletion(-) diff --git a/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/MPJWTInitializer.java b/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/MPJWTInitializer.java index 51da2f40b0..f2d6465f4e 100644 --- a/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/MPJWTInitializer.java +++ b/mp-jwt/src/main/java/org/apache/tomee/microprofile/jwt/MPJWTInitializer.java @@ -42,7 +42,7 @@ public class MPJWTInitializer implements ServletContainerInitializer { for (Class<?> clazz : classes) { final LoginConfig loginConfig = clazz.getAnnotation(LoginConfig.class); - if (loginConfig.authMethod() == null && !"MP-JWT".equals(loginConfig.authMethod())) { + if (loginConfig == null || !"MP-JWT".equals(loginConfig.authMethod())) { continue; } diff --git a/mp-jwt/src/test/java/org/apache/tomee/microprofile/jwt/MPJWTInitializerTest.java b/mp-jwt/src/test/java/org/apache/tomee/microprofile/jwt/MPJWTInitializerTest.java new file mode 100644 index 0000000000..86e5725ad6 --- /dev/null +++ b/mp-jwt/src/test/java/org/apache/tomee/microprofile/jwt/MPJWTInitializerTest.java @@ -0,0 +1,84 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.tomee.microprofile.jwt; + +import jakarta.servlet.FilterRegistration; +import jakarta.servlet.ServletContext; +import jakarta.ws.rs.core.Application; +import org.eclipse.microprofile.auth.LoginConfig; +import org.junit.Test; + +import java.lang.reflect.Proxy; +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; +import java.util.Set; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +public class MPJWTInitializerTest { + + @LoginConfig(authMethod = "MP-JWT") + public static class MpJwtApplication extends Application { + } + + @LoginConfig(authMethod = "BASIC") + public static class BasicApplication extends Application { + } + + @LoginConfig(authMethod = "FORM") + public static class FormApplication extends Application { + } + + @Test + public void filterIsRegisteredForMpJwt() throws Exception { + final List<String> filters = startup(MpJwtApplication.class); + assertEquals(Collections.singletonList("mp-jwt-filter"), filters); + } + + @Test + public void filterIsNotRegisteredForBasic() throws Exception { + assertTrue(startup(BasicApplication.class).isEmpty()); + } + + @Test + public void filterIsNotRegisteredForForm() throws Exception { + assertTrue(startup(FormApplication.class).isEmpty()); + } + + private static List<String> startup(final Class<?> clazz) throws Exception { + final List<String> filters = new ArrayList<>(); + final ClassLoader loader = MPJWTInitializerTest.class.getClassLoader(); + + final FilterRegistration.Dynamic registration = (FilterRegistration.Dynamic) Proxy.newProxyInstance( + loader, new Class<?>[]{FilterRegistration.Dynamic.class}, (proxy, method, args) -> null); + + final ServletContext context = (ServletContext) Proxy.newProxyInstance( + loader, new Class<?>[]{ServletContext.class}, (proxy, method, args) -> { + if ("addFilter".equals(method.getName())) { + filters.add((String) args[0]); + return registration; + } + return null; + }); + + final Set<Class<?>> classes = Collections.singleton(clazz); + new MPJWTInitializer().onStartup(classes, context); + return filters; + } +}
