DefaultJaxRsRolesAllowedImplMethodSecuredTest produces a large number of errors

[mkouba]

Description

And produces 6K+ of useless lines in the log.

Implementation ideas

No response

[geoand]

@mkouba are you looking at it or do you want me to?

[michalvavrik]

which one, Quarkus REST or RESTEasy Classic one?

[mkouba]

@mkouba are you looking at it or do you want me to?

I'm not. Feel free to take it ;-)

[mkouba]

which one, Quarkus REST or RESTEasy Classic one?

Quarkus REST -> https://github.com/quarkusio/quarkus/blob/main/extensions/resteasy-reactive/rest/deployment/src/test/java/io/quarkus/resteasy/reactive/server/test/security/inheritance/DefaultJaxRsRolesAllowedImplMethodSecuredTest.java

[michalvavrik]

I see. Yes, that error is expected, when is security check run - it must not get to serialization unless you are authentication/authorized. So @geoand I think you can just silence it (if you want, or it has to wait till weekend, I am busy ATM). It doesn't signal anything security-wise wrong.

[michalvavrik]

btw, I suppose it will be true for many classes in that package, I didn't realize that.

[mkouba]

Yes, that error is expected, when is security check run - it must not get to serialization unless you are authentication/authorized.

Well, I can see errors like:

Caused by: io.vertx.core.json.DecodeException: Failed to decode:Unexpected close marker '}': expected ']' (for root starting at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1])

Is that really expected?

[michalvavrik]

Is that really expected?

What test does with invalid payload is:

• are you authorized to reach that endpoint? then you get to the serializers and serialization fails => 500
• are you not authorized to reach that endpoint? then you don't get to the serializers and security checks must forbid access => 401/403

It is a way to recognize whether security check is performed by CDI interceptors or eagerly. HTTP statuses are what you care about.

[michalvavrik]

cc @sberyozkin anyway, just to assure @mkouba

[geoand]

The Jackson error is indeed expected. We simply need to not log it - I'll have a look

[michalvavrik]

I'll have a look

Thank you. Please check other test classes in that package.