RewriteHandler with multiple HeaderPatternRules

[janitza-bjag]

Jetty Version
12.0.1

Jetty Environment
core, ee8

Java Version
17.0.8

Question
I added some HeaderPatternRules to a RewriteHandler, but only the last rule applies. What I am doing wrong? I assumed that all matching rules will apply...

private static final HeaderPatternRule CONTENT_TYPE_OPTIONS = new HeaderPatternRule("*", "X-Content-Type-Options", "nosniff");
private static final HeaderPatternRule XSS_PROTECTION = new HeaderPatternRule("*", "X-XSS-Protection", "0");
private static final HeaderPatternRule PERMISSION_POLICY = new HeaderPatternRule("*", "Permissions-Policy", "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), " +
            "camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), " +
            "execution-while-out-of-viewport=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), " +
            "midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()");
private static final HeaderPatternRule REFERRER_POLICY = new HeaderPatternRule("*", "Referrer-Policy", "no-referrer");

RewriteHandler rh = new RewriteHandler();

rh.addRule(REFERRER_POLICY);
rh.addRule(PERMISSION_POLICY);

rh.addRule(XSS_PROTECTION);
rh.addRule(CONTENT_TYPE_OPTIONS);

[sbordet]

@janitza-bjag I am unsure what you are trying to achieve with a pattern of * for your rules.

The pattern should be a Servlet pattern as defined in the Servlet specification here:
https://jakarta.ee/specifications/servlet/6.0/jakarta-servlet-spec-6.0#specification-of-mappings

Your mapping of * does not match anything, so no rule applies.
I am surprised you say the last rule matches, as it should not.

Please fix your patterns depending on your logic and report back if this issue is fixed.

[janitza-bjag]

@sbordet Thanks for your reply.

We had the above code working with Jetty 10.0.15
The intention was to add all the security headers to every requests ...

Is there another preferred way to do so?

[sbordet]

@janitza-bjag If you want to make the rules trigger for every request for every request path, use the /* pattern (like you would do for a normal Servlet/Filter).

It feels like a bug that * only worked on 10/11.

[janitza-bjag]

@sbordet If I use the /* pattern in the above code only the last rule "CONTENT_TYPE_OPTIONS" applied. All other headers are not set ... really weird

[made-in-nz]

Probably no surprise, but the same situation when configuring multiple rules via $JETTY_BASE/etc/jetty-rewrite-rules.xml. Only the last addRule is applied.
We also only ever used a pattern of * in Jetty 9.4.x & 10.0.x to set a header for all responses.

[sbordet]

Confirmed that there is a bug, we do not process the rules properly in 12.

I still recommend that you use /* rather than * for matching, as the bug is an orthogonal issue with respect to the pattern.

[sbordet]

@janitza-bjag @made-in-nz are you able to try out PR #10572 and report whether the issue is fixed for you?

Thanks!

[made-in-nz]

@sbordet Yes, I can confirm this fixes it. Thank you!

[janitza-bjag]

@sbordet

@janitza-bjag @made-in-nz are you able to try out PR #10572 and report whether the issue is fixed for you?

Thanks!

The PR fixes it, thanks!