users@jaspic-spec.java.net

Clarification for secureResponse and async Servlets

From: arjan tijms <arjan.tijms_at_gmail.com>
Date: Wed, 21 Oct 2015 14:04:37 +0200

Hi,

On the JBoss dev mailing list the question came up how the lifecycle of a
SAM should be handled when an async Servlet is used. See
http://lists.jboss.org/pipermail/wildfly-dev/2015-October/004526.html

What the RI (among others) now does is the following:

1. Request starts
2. SAM validateRequest invoked
2. Filter doFilter() invoked, before/in chain.doFilter()
3. Servlet invoked, starts async, returns
4. Filter after chain.doFilter(), returns
5. SAM secureResponse invoked
6. Other thread writes to response, calls AsyncContext#complete()
7. Request ends

This is quite like how a Servlet Filter behaves, with the small difference
that a filter explicitly declares it's okay with async dispatches happening
via the "asyncSupported = true" attribute.

Since the JASPIC spec doesn't mention async, what should be the behavior
here? Should the spec perhaps be updated with a key in the MessageInfo map
via which a SAM can say whether it supports async or not?

Kind regards,
Arjan Tijms