Skip to content

Adding fix for #SLING-12406 #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pat-lego wants to merge 1 commit into
base: master
Choose a base branch
from
+7 −0
Open

Adding fix for #SLING-12406 #16

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions src/main/java/org/apache/sling/auth/core/impl/SlingAuthenticator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -406,6 +406,9 @@ public static String getHttpAuth(final Config config) {
@Override
public boolean handleSecurity(HttpServletRequest request,
HttpServletResponse response) {
if(request.getHeader("x-request-id") != null) {

@jsedding jsedding Aug 16, 2024

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my opinion the value of "x-request-id" should be configurable. If blank, don't set the thread name.

Also note that on Jetty the thread name includes the request method and path, with this change this information is lost, unless it is in the special header.

@pat-lego pat-lego Aug 19, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The request path and method would still persist as we are not overriding the function call made here https://github.com/apache/sling-org-apache-sling-engine/blob/master/src/main/java/org/apache/sling/engine/impl/SlingMainServlet.java#L107 but instead we are simply adding the ability to trace the authentication logs to the edge logs allowing for visibility into the authentication process.

setThreadName(request.getHeader("x-request-id"));
}
// 0. Nothing to do, if the session is also in the request
// this might be the case if the request is handled as a result
// of a servlet container include inside another Sling request
Expand Down Expand Up @@ -444,6 +447,10 @@ public boolean handleSecurity(HttpServletRequest request,
return process;
}

private void setThreadName(String xRequestId) {
Thread.currentThread().setName(xRequestId);
}

private boolean doHandleSecurity(HttpServletRequest request, HttpServletResponse response) {

// 0. Check for request attribute; set if not present
Expand Down