Document the difference in dispatch type and the effect on the security filter caused by the error page filter when deployed to a standalone container

[ravi-dalal]

I am using following code in my controller to display a custom error page in the application:

@GetMapping(path="/error")
public ModelAndView error (Principal principal) {
	ModelAndView model = new ModelAndView("error");
	model.addObject("userName", principal.getName());
	return model;
}

The principal is null when application is deployed as a WAR on stand-alone tomcat. When application is run with embedded tomcat, it works fine.

[wilkinsona]

Thanks for the report. Can you please provide a minimal sample that reproduces the problem?

[ravi-dalal]

myapp.zip
Please find attached the sample code to reproduce the issue. Please follow these steps to reproduce:

1. Deploy on tomcat (you can do it within Eclipse, I used Tomcat 9)
2. Browse http://localhost:8080/myapp, Spring login page will prompt for login
3. Login using credentials user/password
4. After successful login, change url to http://localhost:8080/myapp/api/admin
5. You will get null pointer exception for 'prinicipal' object
6. the /api/** url can be accessed only by 'admin' user
7. If you run this application as a simple Java application (using embedded Tomcat), you will see the error page when trying to access /api/admin url while logged in as 'user'.

[wilkinsona]

Thanks for the sample.

When you deploy your application to a container, Spring Boot has to use a filter to forward errors to its custom error page support. This is necessary as the Servlet spec does not include an API for error page registration. By default, Spring Security's filter only runs async, error, and request dispatches. This means that it does not get involved when the error page filter forwards the request to the custom error page support. You can change this by setting the spring.security.filter.dispatcher-types property to async, error, forward, request. Doing so in your sample fixes the problem.

We should add something to the documentation about this. We can use this issue to do that.

[ravi-dalal]

Yes, it resolves the issue. Thanks for your help.