spring-projects / spring-projects/spring-security
`HeaderWriterFilter` appears to be violating Servlet spec
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Servlet spec states that include dispatch:
... cannot set headers or call any method that affects the headers of the response... Any attempt to set the headers must be ignored...
HeaderWriterFilter appears to be at odds with this as it invokes HeaderWriterResponse#onResponseCommitted in HeaderWriterRequestDispatcher#include, which in turn calls HeaderWriterResponse#writeHeaders.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with HeaderWriterRequestDispatcher#include and trace its call to HeaderWriterResponse#onResponseCommitted and HeaderWriterResponse#writeHeaders. Compare this behavior with the Servlet specification's include-dispatch rules and determine the expected handling of response headers. The issue is done when include dispatch no longer violates those rules and the behavior is covered by appropriate regression tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100