response.sendRedirect and orbeon filter

Hi All,

I'm trying to integrate an application with orbeon with separate deployment.
I've problem with our security filter that doing a response.sendRedirect when user is not allowed to access the page.

I notice that as part of orbeon filter, it wraps the response object and sendRedirect method is not implemented yet. more over it always forward the request to the xform processor regardless there is content or not. has anyone come accross the same issue ? and anyone know what is the best way to handle this issue?

Currently I modified the filter code to work around this:

in OPSXFormsFilter$MyHttpServletResponseWrapper, send the call to it's super class :

        public void sendRedirect(String string) throws IOException {
            super.sendRedirect(string);
        }

in OPSXFormsFilter.doFilter

I only forward to xform processor when there is content to be rendered, otherwise just return and let the filterChain finish its life naturally. assuming that when sendRedirect is used, no content is available in the response object.

      if (!StringUtils.isBlank(responseWrapper.getContent()))
            getOPSDispatcher(OPS_RENDERER_PATH).forward(httpRequest, httpResponse);

Thanks,
Musang.

Does anyone here sees this as a problem ?

Personally I think it is a problem or even a bug, because Orbeon filter always assume that it is the last filter to be executed and everything should go to the XForms engine which in my case no content is be available for parsing which then make Orbeon throws exception.

Any comments ?

Thanks.

musang wrote

Hi All,

I'm trying to integrate an application with orbeon with separate deployment.
I've problem with our security filter that doing a response.sendRedirect when user is not allowed to access the page.

I notice that as part of orbeon filter, it wraps the response object and sendRedirect method is not implemented yet. more over it always forward the request to the xform processor regardless there is content or not. has anyone come accross the same issue ? and anyone know what is the best way to handle this issue?

Currently I modified the filter code to work around this:

in OPSXFormsFilter$MyHttpServletResponseWrapper, send the call to it's super class :

        public void sendRedirect(String string) throws IOException {
            super.sendRedirect(string);
        }

in OPSXFormsFilter.doFilter

I only forward to xform processor when there is content to be rendered, otherwise just return and let the filterChain finish its life naturally. assuming that when sendRedirect is used, no content is available in the response object.

      if (!StringUtils.isBlank(responseWrapper.getContent()))
            getOPSDispatcher(OPS_RENDERER_PATH).forward(httpRequest, httpResponse);

Thanks,
Musang.

Musang,

On Sep 3, 2008, at 7:15 PM, musang wrote:

> I notice that as part of orbeon filter, it wraps the response object  
> and
> sendRedirect method is not implemented yet. more over it always  
> forward the
> request to the xform processor regardless there is content or not. has
> anyone come accross the same issue ? and anyone know what is the  
> best way to
> handle this issue?

Let me see if I understand this correctly: you are saying that if the  
JSP (or servlet) responds with a redirect, then the filter shouldn't  
try to process the content. Is that right?

If it is, do the two changes you did (implement sendRedirect(), and  
only process the content if no blank) do the trick?

Alex
--
Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
Orbeon's Blog: http://www.orbeon.com/blog/
Personal Blog: http://avernet.blogspot.com/
Twitter - http://twitter.com/avernet



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
OW2 mailing lists service home page: http://www.ow2.org/wws

Hi Alex,

That is correct, I think the reason we want to forward the request to Orbeon is when there is XForms content to be handle. But in the sendRedirect scenario, we just need to redirect in my opinion.

Yes the two changes do the trick for me, but that's my little hack in the code to keep my demo going :).
I think, to have more control over this, we can save a state in the wrapper when sendRedirect is called and check that state in the filter (e.g. : isByPassXFormEngine()) to decide if we need to forward it to the XForm engine, this is more precise way of handling it. because I'm not sure if we can make this "blank content" assumption, since empty/blank content can be caused by many different things.

Thanks,
Musang.

<quote author="Alessandro Vernet">
Musang,

On Sep 3, 2008, at 7:15 PM, musang wrote:

> I notice that as part of orbeon filter, it wraps the response object  
> and
> sendRedirect method is not implemented yet. more over it always  
> forward the
> request to the xform processor regardless there is content or not. has
> anyone come accross the same issue ? and anyone know what is the  
> best way to
> handle this issue?

Let me see if I understand this correctly: you are saying that if the  
JSP (or servlet) responds with a redirect, then the filter shouldn't  
try to process the content. Is that right?

If it is, do the two changes you did (implement sendRedirect(), and  
only process the content if no blank) do the trick?

Alex
--
Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
Orbeon's Blog: http://www.orbeon.com/blog/
Personal Blog: http://avernet.blogspot.com/
Twitter - http://twitter.com/avernet

Musang,

musang wrote

Hi Alex,

That is correct, I think the reason we want to forward the request to Orbeon is when there is XForms content to be handle. But in the sendRedirect scenario, we just need to redirect in my opinion.
[...]

Your change is in. Thank you for the contribution! (And sorry for the time it took us to put this in.) For reference, the bug is:

http://forge.ow2.org/tracker/index.php?func=detail&aid=313749&group_id=168&atid=350207

Alex