PaulGale opened a new issue, #2659:
URL: https://github.com/apache/activemq/issues/2659
Affects: 6.3.0, 6.3.1, 6.3.2, and main (webconsole). It was introduced in
6.3.0; 6.2.x does not use jetty-webapps.xml.
**Problem**
Since the Jetty 12 / EE11 migration (AMQ-9359), the web console no longer
sends the security headers added by AMQ-7265, AMQ-9545 and AMQ-9697, such as
`X-Frame-Options`, `Content-Security-Policy` and `X-Content-Type-Options`. The
rules are still defined, but they never run.
**Steps to reproduce** (stock binary distribution, default config)
Unpack apache-activemq-6.3.1-bin.tar.gz and run bin/activemq start.
curl -s -o /dev/null -D - -u <admin user>:<password>
http://127.0.0.1:8161/admin/
Expected: `200` with the headers defined in `conf/jetty/jetty-webapps.xml`.
Actual: `200` with none of them.
**Cause**
`conf/jetty/jetty-webapps.xml` adds the header `RewriteHandler` to the
Contexts `ContextHandlerCollection` as a sibling of the `/admin` and `/api`
WebAppContexts, with no child handler. `ContextHandlerCollection` only routes
requests to handlers that contain a `ContextHandler`, so the `RewriteHandler`
is never on the request path for the webapps. When it is reached, it fails with
`IllegalStateException: RewriteHandler: Child handler is not set. (HTTP 500)`.
**Suggested fix**
Insert the `RewriteHandler` into the Server's handler chain so that it wraps
Contexts, for example with `Server.insertHandler(...)`, instead of adding it to
Contexts. Then add a test that asserts one of the headers on an authenticated
/admin/ response.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
For further information, visit: https://activemq.apache.org/contact
