Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix Accept header in HTTP requests #5

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix Accept header in HTTP requests #5

wants to merge 1 commit into from

Conversation

frasertweedale
Copy link

The ClientOperation.ProducesMediaTypes field determines the value of
the HTTP Accept header in requests. The current implementation
causes /cacerts, /simpleenroll and /simplereenroll requests to be
sent with header Accept: text/plain. This is incorrect, and can
result in EST servers reponding with status 406 Not Acceptable. Use
the correct value: application/pkcs7-mime.

@frasertweedale
fix Accept header in HTTP requests
242cb9e 
The ClientOperation.ProducesMediaTypes field determines the value of
the HTTP Accept header in requests.  The current implementation
causes /cacerts, /simpleenroll and /simplereenroll requests to be
sent with header `Accept: text/plain`.  This is incorrect, and can
result in EST servers reponding with status 406 Not Acceptable.  Use
the correct value: `application/pkcs7-mime`.

Signed-off-by: Fraser Tweedale <[email protected]>
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 5, 2022
@frasertweedale
EST: handle dubious Accept headers
44272b0 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 5, 2022
@frasertweedale
EST: handle dubious Accept headers
f7cc4ff 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 5, 2022
@frasertweedale
EST: handle dubious Accept headers
c26beb4 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 6, 2022
@frasertweedale
EST: handle dubious Accept headers
b41a193 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 6, 2022
@frasertweedale
EST: handle dubious Accept headers
d924a7f 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 6, 2022
@frasertweedale
EST: handle dubious Accept headers
8c9b5da 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 7, 2022
@frasertweedale
EST: handle dubious Accept headers
15352fd 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 12, 2022
@frasertweedale
EST: handle dubious Accept headers
c0c4c17 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 15, 2022
@frasertweedale
EST: handle dubious Accept headers
cd277fb 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 19, 2022
@frasertweedale
EST: handle dubious Accept headers
8b6278d 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 20, 2022
@frasertweedale
EST: handle dubious Accept headers
d3ad4de 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 26, 2022
@frasertweedale
EST: handle dubious Accept headers
78081a3 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 26, 2022
@frasertweedale
EST: handle dubious Accept headers
3e7bee5 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Jul 28, 2022
@frasertweedale
EST: handle dubious Accept headers
c0573e8 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 4, 2022
@frasertweedale
EST: handle dubious Accept headers
73f32b2 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 17, 2022
@frasertweedale
EST: handle dubious Accept headers
0eecbb5 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 22, 2022
@frasertweedale
EST: handle dubious Accept headers
72d2b58 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 24, 2022
@frasertweedale
EST: handle dubious Accept headers
b06ada9 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 24, 2022
@frasertweedale
EST: handle dubious Accept headers
917c85f 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 25, 2022
@frasertweedale
EST: handle dubious Accept headers
32861cd 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 25, 2022
@frasertweedale
EST: handle dubious Accept headers
1214d09 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 25, 2022
@frasertweedale
EST: handle dubious Accept headers
47c44d7 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 25, 2022
@frasertweedale
EST: handle dubious Accept headers
0cc5f7c 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 25, 2022
@frasertweedale
EST: handle dubious Accept headers
bd45cef 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 25, 2022
@frasertweedale
EST: handle dubious Accept headers
4dc605a 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 26, 2022
@frasertweedale
EST: handle dubious Accept headers
b65f48d 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 26, 2022
@frasertweedale
EST: handle dubious Accept headers
db594f2 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Aug 31, 2022
@frasertweedale
EST: handle dubious Accept headers
0b66d98 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Sep 6, 2022
@frasertweedale
EST: handle dubious Accept headers
757c0e6 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Sep 7, 2022
@frasertweedale
EST: handle dubious Accept headers
2e6d4e1 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Sep 8, 2022
@frasertweedale
EST: handle dubious Accept headers
10d5b5f 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
ckelleyRH pushed a commit to ckelleyRH/pki that referenced this pull request Sep 14, 2022
@frasertweedale @ckelleyRH
EST: handle dubious Accept headers
f435fcc 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Sep 15, 2022
@frasertweedale
EST: handle dubious Accept headers
9e5c369 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Sep 15, 2022
@frasertweedale
EST: handle dubious Accept headers
22f6f41 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Sep 15, 2022
@frasertweedale
EST: handle dubious Accept headers
8646a82 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Sep 20, 2022
@frasertweedale
EST: handle dubious Accept headers
914324a 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
fmarco76 pushed a commit to fmarco76/pki that referenced this pull request Sep 23, 2022
@frasertweedale @fmarco76
EST: handle dubious Accept headers
2c13270 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Sep 27, 2022
@frasertweedale
EST: handle dubious Accept headers
994c710 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Oct 11, 2022
@frasertweedale
EST: handle dubious Accept headers
b801612 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Oct 26, 2022
@frasertweedale
EST: handle dubious Accept headers
e9a4957 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Oct 31, 2022
@frasertweedale
EST: handle dubious Accept headers
89fdce0 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Nov 2, 2022
@frasertweedale
EST: handle dubious Accept headers
e2a5e2d 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Nov 2, 2022
@frasertweedale
EST: handle dubious Accept headers
d6c0585 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Nov 15, 2022
@frasertweedale
EST: handle dubious Accept headers
7b5cc76 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Nov 29, 2022
@frasertweedale
EST: handle dubious Accept headers
6558d83 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to dogtagpki/pki that referenced this pull request Nov 29, 2022
@frasertweedale
EST: handle dubious Accept headers
10357a3 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: #3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Dec 13, 2022
@frasertweedale
EST: handle dubious Accept headers
4873321 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
frasertweedale added a commit to frasertweedale/pki that referenced this pull request Dec 13, 2022
@frasertweedale
EST: handle dubious Accept headers
8c5c4c6 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: dogtagpki#3297
fmarco76 pushed a commit to dogtagpki/pki that referenced this pull request Dec 14, 2022
@frasertweedale @fmarco76
EST: handle dubious Accept headers
8678022 
At least one EST client is known to send requests with HTTP header
`Accept: text/plain`; see
thales-e-security/estclient#5.

This behaviour is dubious.  It is problematic when communicating
with servers/frameworks that have rigid content negotiation
behaviour (such as JAX-RS).  Nevertheless, the EST protocol uses a
narrow range of media types.  The method and path are sufficient to
determine the request and response media types, regardless of
Content-Type and Accept header values.

To tolerate bogus Accept header values, define and apply a
ContainerRequestFilter that detects when the Accept header does not
match any of the response types used in the EST protocol.  If it
detects this condition it removes the Accept header from the
request.

NOTE: the JAX-RS spec is ambiguous as to whether our use of the API
is legal.  Per the spec,
`ContainerRequestContext.getAcceptableMediaTypes()` returns an
IMMUTABLE `List<MediaType>`.  However,
`ContainerRequestContext.getHeaders()` returns a MUTABLE map of
headers.  We are able to delete the Accept header via that map.  It
seems to be a RestEasy implementation detail that
`getAcceptableMediaTypes()` always reads the Accept header afresh
from the mutable map.

Part of: #3297
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@frasertweedale