spring-projects / spring-projects/spring-security
SEC-2786: Allow use of Spring Security filters in applications that make use of Servlet 3.1 Async I/O
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Rossen Stoyanchev (Migrated from SEC-2786) said:
There are plans to enable use of Servlet 3.1 Async I/O for SockJS in Spring Framework 4.2 (see SPR-12427). However when Spring Security is also used the following error occurs:
java.lang.AbstractMethodError: javax.servlet.ServletOutputStream.setWriteListener(Ljavax/servlet/WriteListener;)V
This is most likely due to Spring Security wrapping the response (and ServletOutputStream) but not implementing the 3.1 specific abstract methods.
It would also be generally useful for Spring Security to work with applications that rely on Servlet 3.1 async I/O.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the Spring Security response and ServletOutputStream wrappers implicated by the AbstractMethodError, along with Servlet 3.1 Async I/O usage. Reproduce the failure in an application using Spring Security and async I/O, then verify that the wrapped response supports the required Servlet 3.1 behavior without the reported error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100