8000 Routing Exceptions might induce Spring whitelabel error page · Issue #530 · scc-digitalhub/AAC · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Routing Exceptions might induce Spring whitelabel error page #530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
8000
thomaschiozzi-tndigit opened this issue Feb 9, 2024 · 5 comments
Closed

Routing Exceptions might induce Spring whitelabel error page #530

thomaschiozzi-tndigit opened this issue Feb 9, 2024 · 5 comments
Labels
5.x bug

Comments

@thomaschiozzi-tndigit
Copy link
Collaborator

Some exceptions might induce some amount of information discolusure or in general provides an undesirable user experience due to the default that they trigger a default or whitelabel error page.
As far as I know, this behaviour was only discovered when making malfored requests. For example the following page is returned when making a request to /console/dev/realms/system/users?{ due to the fact that it contains the character { .

image
@matteo-s
Copy link
Collaborator
matteo-s commented Feb 9, 2024

That is not the whitelabel error page but the tomcat error page, and is served by tomcat outside the application.
Given that it is not handled by AAC we should investigate tomcat configuration in order to either disable the default error pages or replace it with a static html page.

@thomaschiozzi-tndigit
Copy link
Collaborator Author

Including additional information for future reference and general insight. The following open issue in the Spring project discusses this very same problem

spring-projects/spring-boot#21257

It appears that Spring does not offer any configuration for application.* file that manages this problem.
If I understand correctly, it appears that the suggested approach is to override the default configuration of the embedded tomcat server inside spring.

8000 @matteo-s
Copy link
Collaborator
matteo-s commented Feb 9, 2024

Yes, as far as I know that is the only way. If you want to, try it in a branch.
I'm fine with a blank error page + logging.

@thomaschiozzi-tndigit
Copy link
Collaborator Author

If information discolsure is the primary concern, it appears that the Spring application property server.error.include-stacktrace: never suffices to minimize the amount of information included in the tomcat error page.
Se picture below, produced by a request with a malformed URL (as it includes the { character).

image

@matteo-s
Copy link
Collaborator

closed with #536

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
5.x bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@matteo-s @thomaschiozzi-tndigit
0