Utkarsh-rwt opened a new pull request, #2676:
URL: https://github.com/apache/activemq/pull/2676
## Description
Fix the missing HTTP security headers in the ActiveMQ web console following
the migration to Jetty 12 / EE11.
The `RewriteHandler` was configured as a sibling of the `/admin` and `/api`
web application contexts inside `ContextHandlerCollection`. As a result,
requests could reach these contexts without passing through the rewrite rules
responsible for adding the configured security headers.
This change inserts the `RewriteHandler` into the server's handler chain so
that it wraps the context collection and processes requests before they reach
the web applications.
### Changes Made
- Updated `assembly/src/release/conf/jetty/jetty-webapps.xml` to insert the
`RewriteHandler` into the server's handler chain using
`Server.insertHandler(...)`.
- Applied the same handler configuration change to
`activemq-web-console/src/test/resources/jetty/jetty-webapps.xml` to keep the
integration test environment consistent with production.
- Extended `JettyServerBeanTest` to make an authenticated request to
`/admin/` and verify that the response contains `X-Frame-Options: SAMEORIGIN`.
- Preserved the existing security header values and authentication behavior.
### Testing
The following validations were performed:
- [x] Focused Maven test completed successfully.
- [x] Both modified XML configuration files passed `xmllint` validation.
- [x] `git diff --check` completed without errors.
**Test command:**
```bash
mvn -pl activemq-web-console -am \
-Dtest=JettyServerBeanTest \
-Dsurefire.failIfNoSpecifiedTests=false \
test
```
**Result:** `BUILD SUCCESS`
### Screenshots
**Regression test / test execution**
<img width="500" alt="Regression test execution"
src="https://github.com/user-attachments/assets/e1f6f385-132b-440c-8589-6e94b34255c2";
/>
**HTTP response headers**
<img width="650" alt="HTTP response headers"
src="https://github.com/user-attachments/assets/9ef30537-7b73-4d96-bdcd-202b9f3f83c4";
/>
<!-- Attach a screenshot showing X-Frame-Options: SAMEORIGIN in the
authenticated /admin/ response, if captured. -->
### Related Issue
Closes #2659
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
For further information, visit: https://activemq.apache.org/contact
