Unauthorized response on a unprotected endpoint, when a JWT is sent but not injected /FISH-6022

[fschuerer]

Description

---

Unauthorized response on a unprotected endpoint when a JWT is sent, without token injection.
See also microprofile-jwt-auth issue response

Expected Outcome

The endpoint is called and responds

Current Outcome

Status code 401

Steps to reproduce

@Path("ping")
public class PingResource    {
    
   @GET
    public String ping() {
        return "everybody is authorized";
    }

Environment

Payara Version: 5.2021.7
Edition: Full
JDK Version: OpenJDK 11
Operating System: Windows 10

[fturizo]

@fschuerer, sorry but a quick test on 5.2021.10 doesn't yield any errors from calling un-restricted (i.e, no authorization constraints present) JAX-RS endpoints, all calls execute without problems. Please make sure to test your scenario on this release to confirm that this is the case, and if the issue is present on your end, please share a complete self-contained reproducer that we can test on our end.

[fschuerer]

Hello @fturizo,

I created a small sample https://github.com/fschuerer/payara-5582 and testet it on 5.2021.10.
The public key was created with JWTenizr.

Request without a token: Response 200
curl `http://localhost:8080/payara-5582/resources/ping

Request with an invalid token: Response 401
curl -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' http://localhost:8080/payara-5582/resources/ping

[fturizo]

Greetings @fschuerer, thanks for sharing more details as requested, they helped clarify the issue. Indeed, it seems that the server runtime is triggering the token validation when it shouldn't, since the endpoints do not require authentication/authorization.

I have escalated this issue with the ID FISH-6022 so that our Platform Developers are able to fix it in a future release. Keep in mind that this issue is of low priority for the moment, so it'll take some time until a fix is available.