[
https://issues.apache.org/jira/browse/SOLR-17708?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18132885#comment-18132885
]
Eric Pugh commented on SOLR-17708:
----------------------------------
Just wanted to tag that SOLR-18579 is apparenlty a "Collection" level fix, but
we don't yet have a "Core" level fix. I had made a comment to that effect on
the PR that was opened against SOLR-18579.
Super exciting to see folks starting to work with V2 and finding the rough
edges!
> JAX-RS v2 APIs go through authorization twice
> ---------------------------------------------
>
> Key: SOLR-17708
> URL: https://issues.apache.org/jira/browse/SOLR-17708
> Project: Solr
> Issue Type: Bug
> Components: Authorization, v2 API
> Affects Versions: 9.8.1, 10.0
> Reporter: Jason Gerlowski
> Priority: Major
>
> Currently, v2 APIs implemented in JAX-RS go through authorization twice:
> # Once in
> ["HttpSolrCall.call()"|https://github.com/apache/solr/blob/main/solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java#L534-L544],
> where authorization has historically always happened for v1 and non-JAXRS
> APIs
> # And once again in
> [SolrRequestAuthorizer|https://github.com/apache/solr/blob/main/solr/core/src/java/org/apache/solr/jersey/SolrRequestAuthorizer.java#L89],
> a
> ["pre-filter"|https://www.baeldung.com/jersey-filters-interceptors#1-implementing-a-request-server-filter]
> that runs *after* the request has been submitted to Jersey but *before* the
> API implementation is actually triggered
> I think the idea, [when JAX-RS support was initially
> added|https://github.com/apache/solr/pull/975], was that they would be
> skipped over by HttpSolrCall's authorization logic, and only authorized by
> the SolrRequestAuthorizer pre-filter, but the logic for this was never added.
> We should modify this logic so that JAX-RS APIs are only authorized a single
> time.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
