You are viewing a plain text version of this content. The canonical link for it is here.
Posted to gitbox@activemq.apache.org by "PaulGale (via GitHub)" <gi...@apache.org> on 2026/10/13 18:38:16 UTC
[I] [6.3.x] Web console security headers are not sent (RewriteHandler in jetty-webapps.xml never wraps the webapps) [activemq]
PaulGale opened a new issue, #2659:
URL: https://github.com/apache/activemq/issues/2659
Affects: 6.3.0, 6.3.1, 6.3.2, and main (webconsole). It was introduced in 6.3.0; 6.2.x does not use jetty-webapps.xml.
**Problem**
Since the Jetty 12 / EE11 migration (AMQ-9359), the web console no longer sends the security headers added by AMQ-7265, AMQ-9545 and AMQ-9697, such as `X-Frame-Options`, `Content-Security-Policy` and `X-Content-Type-Options`. The rules are still defined, but they never run.
**Steps to reproduce** (stock binary distribution, default config)
Unpack apache-activemq-6.3.1-bin.tar.gz and run bin/activemq start.
curl -s -o /dev/null -D - -u <admin user>:<password> http://127.0.0.1:8161/admin/
Expected: `200` with the headers defined in `conf/jetty/jetty-webapps.xml`.
Actual: `200` with none of them.
**Cause**
`conf/jetty/jetty-webapps.xml` adds the header `RewriteHandler` to the Contexts `ContextHandlerCollection` as a sibling of the `/admin` and `/api` WebAppContexts, with no child handler. `ContextHandlerCollection` only routes requests to handlers that contain a `ContextHandler`, so the `RewriteHandler` is never on the request path for the webapps. When it is reached, it fails with `IllegalStateException: RewriteHandler: Child handler is not set. (HTTP 500)`.
**Suggested fix**
Insert the `RewriteHandler` into the Server's handler chain so that it wraps Contexts, for example with `Server.insertHandler(...)`, instead of adding it to Contexts. Then add a test that asserts one of the headers on an authenticated /admin/ response.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] [6.3.x] Web console security headers are not sent (RewriteHandler in jetty-webapps.xml never wraps the webapps) [activemq]
Posted by "Utkarsh-rwt (via GitHub)" <gi...@apache.org>.
Utkarsh-rwt commented on issue #2659:
URL: https://github.com/apache/activemq/issues/2659#issuecomment-6211003186
Hi @PaulGale I would like to work on it. I'll submit a PR once I've verified the changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact