Can not add the security headers on WebLogic 12c #5945
Description
Summary
We can not add the security headers (e.g. Cache-Controll) via the DelegatingRequestMatcherHeaderWriter with the AntPathRequestMatcher on WebLogic 12c.
The AntPathRequestMatcher use the HttpServletRequest#getServletPath to match the path, and that method return the JSP's path (forwarded by the JstlView) at the HeaderWriterResponse#writeHeaders.
Actual Behavior
- The controller with
@RequestMapping(value = "/foo/bar")invoked, and return the view name "welcome/home". (prefixis "/WEB-INF/views/" andsuffixis ".jsp") - The
JstlViewforward to "/WEB-INF/views/welcome/home.jsp". - The
HeaderWriterResponse#onResponseCommittedis called and theDelegatingRequestMatcherHeaderWriteris invoked, but theAntPathRequestMatcher, that configured with the path "/foo/bar/**", said the path is not match because servlet path pointed to JSP, and not invoked theHeaderWriter.
For that reason, we can not add the security headers to the response on the WebLogic servler.
Expected Behavior
Spring Security should be able to add the security headers to the response via the DelegatingRequestMatcherHeaderWriter with the AntPathRequestMatcher on any servlet container implementation.
Configuration
<bean id="cacheControlHeadersWriter"
class="org.springframework.security.web.header.writers.CacheControlHeadersWriter" />
<bean id="secureCacheControlHeadersWriter"
class="org.springframework.security.web.header.writers.DelegatingRequestMatcherHeaderWriter">
<constructor-arg>
<bean class="org.springframework.security.web.util.matcher.AntPathRequestMatcher">
<constructor-arg value="/foo/bar/**" />
</bean>
</constructor-arg>
<constructor-arg ref="cacheControlHeadersWriter" />
</bean>
<sec:http>
<sec:headers defaults-disabled="true">
<sec:header ref="secureCacheControlHeadersWriter" />
</sec:headers>
<sec:form-login />
<sec:logout />
</sec:http>Version
Spring Security 5.0.7.RELEASE
Spring IO Platform Cairo-SR3
WebLogic 12.2.1.2.0