You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Summary
Filter chain is not working as expected. In some case I want to set the response directly, for example for authorization (i.e return http code 401), in doFilter method and interrupt the process. But even if the http code of the reponse is correctly set (401), the process is not interrupted. The controller with the URL requested is then called (but should not be). Then you received http 401 with a response as if the request was successful.
Steps to reproduce
From aws-serverless-java-container-master\samples\spring\pet-store, modify LambdaHandler.java to add a filter, named TestFilter which will only set response to http 401 when the doFilter method is called (see in attachments). Call url /pets. You will receive a http response code 401 with a list of pets.
Add the TestFilter class (see in attachments):
public class TestFilter implements Filter { @OverRide
public void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain) throws IOException, ServletException {
if(true) {
((HttpServletResponse) res).setStatus(401);
return;
}
chain.doFilter(req, res);
}
Expected Result
I expected the TestFilter doFilter() to interrupt the process if I return before calling chain.doFilter method and then just receive a http reponse code 401 (without the list of pets)
Actual Result
TestFilter doFilter() is executed, the response is set (http code 401) but the controller is actually called and the list of pets returned.
Hey @mianor64, I've committed a fix for this to 0.8-SNAPSHOT in the servlet-improvements branch. I've also added a couple of unit tests for it to the Spark and Spring implementations. If you get a chance, could you help me run a quick test?
Summary
Filter chain is not working as expected. In some case I want to set the response directly, for example for authorization (i.e return http code 401), in doFilter method and interrupt the process. But even if the http code of the reponse is correctly set (401), the process is not interrupted. The controller with the URL requested is then called (but should not be). Then you received http 401 with a response as if the request was successful.
Steps to reproduce
From aws-serverless-java-container-master\samples\spring\pet-store, modify LambdaHandler.java to add a filter, named TestFilter which will only set response to http 401 when the doFilter method is called (see in attachments). Call url /pets. You will receive a http response code 401 with a list of pets.
Add the TestFilter class (see in attachments):
public class TestFilter implements Filter {
@OverRide
public void doFilter(final ServletRequest req, final ServletResponse res, final FilterChain chain) throws IOException, ServletException {
if(true) {
((HttpServletResponse) res).setStatus(401);
return;
}
chain.doFilter(req, res);
}
Expected Result
I expected the TestFilter doFilter() to interrupt the process if I return before calling chain.doFilter method and then just receive a http reponse code 401 (without the list of pets)
Actual Result
TestFilter doFilter() is executed, the response is set (http code 401) but the controller is actually called and the list of pets returned.
aws-serverless-spring-bug.zip
The text was updated successfully, but these errors were encountered: