Spring WebMVC instrumentation alters HTTP Response code in certain scenarios

[kenfinnigan]

Describe the bug

When a Spring Boot application has an endpoint defined that produces a response with an application/pdf content type, the service returning an error results in the response code being modified due to a failure in Spring.

My example is an application that returns a 403 response if the user is forbidden from accessing the endpoint, but when calling the API with the agent present the response becomes 406.

Steps to reproduce

I have a simple project which reproduces the failure: https://github.com/kenfinnigan/otel-spring-reproducer

Package the project with mvn clean package and call the endpoint with curl http://localhost:8080/v4/check/87238923/report -I

Expected behavior

HTTP response code of 403 is returned, as the user is forbidden from accessing the resource

Actual behavior

HTTP response code of 406 is returned, and org.springframework.web.HttpMediaTypeNotAcceptableException: Could not find acceptable representation is logged in the server

Javaagent or library instrumentation version

v1.3.1

Environment

JDK: 8
OS: MacOS

Additional context

I investigated the problem and have identified the root cause.

In OpenTelemetryHandlerMappingFilter.findMapping(), here, getHandler is called. Deep inside the getHandler call, RequestMappingInfoHandlerMapping.handleMatch(), here is called.

The RequestMappingInfoHandlerMapping.handleMatch() method sets several attributes onto the request, including org.springframework.web.servlet.HandlerMapping.producibleMediaTypes. Setting this attribute on the request, causes the error handling to fail as producibleMediaTypes is set to application/pdf from the request mapping. This content type does not match the JSON error response, resulting in an HTTP Response code of 406 being returned and an exception being logged.

Without the agent present, org.springframework.web.servlet.HandlerMapping.producibleMediaTypes is empty when processing the error response, allowing for the default application/json types to be used.

One of the attributes set on the request as part of RequestMappingInfoHandlerMapping.handleMatch() is used by SpringWebMvcServerSpanNaming here.

I'm happy to help with a solution