Wildfly with Basic Auth blocks requests with HTTP POST is not allowed for this method

Question

I have a strange problem which is not reproducible at the moment. I have the following endpoints:

@Path("/v1/")
@Produces(MediaType.APPLICATION_JSON)
public class EndpointVersion1Base
{
    private BackendRestClient restClient;


    @EJB
    public void setRestClient(BackendRestClient restClient)
    {
        this.restClient = restClient;
    }


    @Path("/dataprivacy/")
    public Object getDataPrivacy()
    {
        return new DataPrivacyEndpoint(restClient);
    }

    @Path("/crashreporting/")
    public Object getCrashReport()
    {
        return new CrashReportEndpoint(restClient);
    }
}

The endpoint crashreporting has a Basic authentication. The endpoint dataprivacy has no authentication. The dataprivacy endpoint looks like this:

@Path("/")
@Produces(MediaType.APPLICATION_JSON)
public class DataPrivacyEndpoint
{
    private BackendRestClient restClient;

    private Logger logger = LoggerFactory.getLogger(getClass());

    public DataPrivacyEndpoint(BackendRestClient restClient)
    {
        this.restClient = restClient;
    }

    public DataPrivacyEndpoint()
    {
    }

    @POST
    @Path("/")
    @Consumes(MediaType.APPLICATION_JSON)
    public Response storeConsent(
            @NotNull(message = ErrorCodes.ERR_QUERY_PARAM_NULL) @Valid String consentInputBo) throws ForbiddenException, BadRequestException
    {
        //some code
    }
}

I achieved the Basic Auth of the crashreporting endpoint by the following web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
  <display-name>publicapi</display-name>
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Crash reporting</web-resource-name>
            <description>crash reporting service</description>
            <url-pattern>/v1/crashreporting/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>publicapi</role-name>
        </auth-constraint>
    </security-constraint>
    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>UserRoles simple realm</realm-name>
    </login-config>
    <security-role>
        <role-name>publicapi</role-name>
    </security-role>
</web-app>

and jboss-web.xml

<?xml version="1.0" encoding="UTF-8"?>
<jboss-web xmlns="http://www.jboss.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.jboss.com/xml/ns/javaee http://www.jboss.org/j2ee/schema/jboss-web_5_1.xsd">
    <context-root>publicapi</context-root>
    <security-domain>other</security-domain>
</jboss-web>

Yesterday all this worked. Today I started the services. Suddenly, as I sent a POST request to the dataprivacy endpoint via http://192.168.0.80:8080/publicapi/v1/dataprivacy/ and I got an HTTP error response "HTTP POST is not allowed for this method". I wondered why this happened because it worked yesterday. After I restarted the services it suddenly worked again?!. What is going on here? Why does it sometimes work and sometimes not? (Currently I can't reproduce it). Do I have some misconfiguration in here which could lead to some strange behaviour? I'm afraid that this could happen on my LIVE system as well.

This is probably not the cause of the problem, but if `DataPrivacyEndpoint` is a sub-resource class, it should not be annotated with `@Path`. If it is, and you are classpath scanning for your resources, then it will be registered as a root resource class, which you don't want. also the `@Path("/")` on the method is redundant and is not needed; it is already implied. See [this post](https://stackoverflow.com/a/33520779/2587435). — Paul Samsotha, Nov 12 '18 at 23:27
@PaulSamsotha Thanks. I removed these parts and it is still working. I will proceed with this implementation and watch the behaviour. — Bevor, Nov 13 '18 at 18:23

Wildfly with Basic Auth blocks requests with HTTP POST is not allowed for this method

0 Answers0