NullPointerException from call to ServletApiRequest#getUserPrincipal with Jetty

[Thopap]

NullPointerException from call to ServletApiRequest#getUserPrincipal with Jetty

[joakime]

Cannot invoke "org.eclipse.jetty.server.Request.getAttribute(String)" because "request" is null

That points at use of the HttpServletRequest after the request has been fully processed and has reached a point where it has been recycled, rendering the Request unavailable for further work.

[Thopap]

If i understand the CXF handling correctly for async jax-ws (soap) responses, they are processed in a separate thread when received, since the caller do not expect a response.
So you are right, looks like the original servlet request is already processed.

The question here is, if the behavior for such a case is defined in some way? is the NPE a valid response for such a state? I assume CXF must prevent accessing the HttpServletRequest for such situations.

[joakime]

The question here is, if the behavior for such a case is defined in some way? is the NPE a valid response for such a state?

This is a completely undefined area of the various specs.
All manners of odd and bad behavior exist in this space.

I assume CXF must prevent accessing the HttpServletRequest for such situations.

This is what must happen.
CXF isn't the only one dealing with this kind of issue btw.

See Spring's issue for this as well, (the title is misleading, it happens on many containers, not just Jetty, you can see that from the comments/reports in it)

• spring-projects/spring-security#9175

[Thopap]

Thank you.

I have placed the question in the cxf channel (https://lists.apache.org/thread/ws20fg0xz5sn188k2p28o72sfp33zxy9) and it look like it is already planned to be fixed with their next release https://issues.apache.org/jira/browse/CXF-9004