rishabhdaim opened a new pull request, #29: URL: https://github.com/apache/sling-org-apache-sling-auth-core/pull/29
## Summary `SlingAuthenticator` recurses without bound between `handleLoginFailure` and `getAnonymousResolver` when acquiring the anonymous `ResourceResolver` keeps failing with `LoginException` (e.g. the backing repository is unavailable). The stack grows until `StackOverflowError`, and since each failed request logs the full repeating trace, a sustained failure floods the error log — in the field this grew until the disk filled. The two methods call each other with no termination guard: - `getAnonymousResolver`: on `LoginException` from `getResourceResolver`, calls `handleLoginFailure`; - `handleLoginFailure`: for a `LoginException` with anonymous access still allowed, calls `getAnonymousResolver`. So `getAnonymousResolver → handleLoginFailure → getAnonymousResolver → …` repeats as long as the anonymous login keeps failing. ## Changes - **Fix** (`SlingAuthenticator`): a per-request re-entrancy guard. `getAnonymousResolver` marks (via a request attribute) that anonymous resolution has been attempted; `handleLoginFailure` only falls back to `getAnonymousResolver` when the mark is absent. The anonymous fallback runs at most once per request and terminates normally on repeated failure. All currently-successful paths (including a single legitimate anonymous fallback after a primary-auth failure) are unchanged. - **Test** (`SlingAuthenticatorAnonymousRecursionTest`): drives `getAnonymousResolver` with a `ResourceResolverFactory` that always throws `LoginException` and asserts no `StackOverflowError` and exactly one `getResourceResolver` call. Without the guard it fails with `StackOverflowError` (thousands of recursive calls); with the guard it passes. ## Test Plan - [x] New regression test fails without the fix (StackOverflowError, ~3299 recursive calls), passes with it - [x] Full module test suite green (127 tests) - [x] `spotless:check` clean ## Links - JIRA: https://issues.apache.org/jira/browse/SLING-13353 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
