Comments (21)
Does this occur at startup or when you send a request to the server?
On Oct 25, 2015, at 7:11 AM, shreyasdn [email protected] wrote:
05:04:00.216 [http-nio-8085-exec-4] ERROR o.g.j.s.ServerRuntime$Responder - An I
/O error has occurred while writing a response message entity to the container o
utput stream.
java.lang.IllegalStateException: The output stream has already been closed.
at org.glassfish.jersey.message.internal.CommittingOutputStream.setStrea
mProvider(CommittingOutputStream.java:146) ~[jersey-common-2.14.jar:na]
at org.glassfish.jersey.message.internal.OutboundMessageContext.setStrea
mProvider(OutboundMessageContext.java:798) ~[jersey-common-2.14.jar:na]
at org.glassfish.jersey.server.ContainerResponse.setStreamProvider(Conta
inerResponse.java:372) ~[jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime$Responder.writeResponse(Ser
verRuntime.java:606) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime$Responder.processResponse(S
erverRuntime.java:377) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime$Responder.process(ServerRun
time.java:420) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:27
7) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [jersey-
common-2.14.jar:na]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [jersey-
common-2.14.jar:na]
at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [jersey
-common-2.14.jar:na]
at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [jersey
-common-2.14.jar:na]
at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [jersey
-common-2.14.jar:na]
at org.glassfish.jersey.process.internal.RequestScope.runInScope(Request
Scope.java:297) [jersey-common-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:
254) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHand
ler.java:1030) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:3
77) [jersey-container-servlet-core-2.14.jar:na]
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContaine
r.java:381) [jersey-container-servlet-core-2.14.jar:na]
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContaine
r.java:344) [jersey-container-servlet-core-2.14.jar:na]
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContaine
r.java:221) [jersey-container-servlet-core-2.14.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:291) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52
) [tomcat-embed-websocket-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:239) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(
RequestContextFilter.java:99) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerR
equestFilter.java:107) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:239) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterIntern
al(CharacterEncodingFilter.java:85) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerR
equestFilter.java:107) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:239) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:219) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:106) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(Authentica
torBase.java:502) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:142) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:79) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:88) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:518) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp
11Processor.java:1091) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(
AbstractProtocol.java:673) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpo
int.java:1526) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoin
t.java:1482) [tomcat-embed-core-8.0.26.jar:8.0.26]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.
java:1142) [na:1.8.0_60]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor
.java:617) [na:1.8.0_60]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskTh
read.java:61) [tomcat-embed-core-8.0.26.jar:8.0.26]
at java.lang.Thread.run(Thread.java:745) [na:1.8.0_60]Is there anyone who can help me solve this problem.
—
Reply to this email directly or view it on GitHub.
from appsensor.
Please make sure you are on the latest master. I'm pretty sure we made some POM changes recently to allow this server to boot correctly.
Here are the steps I just took to get it running. If this doesn't work for you I'll need more info to help you trouble shoot.
- Clone latest master
- Switch to
sample-apps/appsensor-ws-rest-server-boot
- Run
mvn spring-boot:run
from appsensor.
I get the above response but when I try through the rest api client with the application header set I get back no response and the above error. Both the rest server and the spring boot servers send the same response error. Let me know if you need more details will provide them.
from appsensor.
I was able to reproduce this by issuing a couple requests to the server, even without the header, the first request gets a proper response and then the second one errors out. Attempting to dig into it.
from appsensor.
Are you using the default header or setting a custom one via config?
from appsensor.
I found a way to resolve the issue that I'm seeing without any header, but the fix leads me to believe that the only way you should be seeing this error is if you aren't passing a header.
@jtmelton I'm not 100% on this yet but looking here:
private final static WebApplicationException unauthorized =
new WebApplicationException(
Response.status(Status.UNAUTHORIZED)
.entity("Page requires sending configured client application identification header.").build());
...
// Get the client application identifier passed in HTTP headers parameters
String clientApplicationIdentifier = context.getHeaderString(HEADER_NAME);
if (clientApplicationIdentifier == null) {
throw unauthorized;
}
context.setProperty(RestRequestHandler.APPSENSOR_CLIENT_APPLICATION_IDENTIFIER_ATTR, clientApplicationIdentifier);
}
You can see how a subsequent request without a header would cause the "unauthorized" error to be thrown. Looking at how this is written, being a final static, I believe the issue is that "Response" is getting reused causing the error. Similar to this example: dropwizard/dropwizard#893
As a test I changed the throw to look like this:
if (clientApplicationIdentifier == null) {
throw new WebApplicationException(
Response.status(Status.UNAUTHORIZED)
.entity("Page requires sending configured client application identification header.").build());
}
This caused me to no longer trigger the IO exception when I send multiple requests without a header but I'm still unsure how this error could be trigged in the case that clientApplicationIdentifier !== null. I'm thinking I'll need to trace further down the request chain to see how the response is handled in those cases. Perhaps it is used off of the context causing a similar issue?
from appsensor.
@shreyasdn thanks for catching this issue - I've not seen it before.
@ProZachJ thanks for jumping in and looking at the result. Yes, this is likely the (or at least an) issue. I should not have been caching the response. There is implicit state there, and it would cause caching issues on multiple requests. I agree I'm not sure how it could be triggered with if the appropriate authz header was sent, though.
I just pushed a change that should resolve this.
@shreyasdn please let me know if that change resolves this issue.
from appsensor.
@ProZachJ thanks a lot for replying so quickly and looking at the issue.
@jtmelton I tried the latest code for the spring boot server and i ran mvn spring-boot:run command but as @ProZachJ said the second response is still throwing the error i got earliar. I just downloaded the latest commit.
from appsensor.
@shreyasdn Ok, is there any way you could send over your code/test case? I can't reproduce. I'm assuming you're using the spring boot rest server, and the rest api client - is that right? Could you send your client code?
from appsensor.
@shreyasdn also, how are you starting up the server? What you should do after pulling the latest code is a 'mvn clean install' from the root appsensor directory (that'll install the rest-server changes I made as well as run the tests). After that, you can run 'mvn spring-boot:run' from the spring boot rest server directory.
from appsensor.
@jtmelton thanks that fixed the issue but why do i get a unauthorized for my request as i have configured to correct client auth header. Please find below the screenshot of my client. Can you tell me if i need to add any other headers?
from appsensor.
@shreyasdn No that looks mostly right. Can you send me the url you were hitting, the verb (get/post) and the content you were sending?
The only thing I see in the screenshot that looks odd is the cookie. Looks like it's a google analytics cookie - that shouldn't be coming from our server. Ours would have a jsessionid cookie.
from appsensor.
i am hitting the url http://localhost:8085/api/v1.0/responses and using get verb and sending no content.
from appsensor.
Ok, I'm using the "Advanced Rest Client" chrome app, and here is my config/response:
from appsensor.
After looking, it appears the request header name and value in yours are quoted. Can you check that?
from appsensor.
Yes that was the issue and just another question how do i add users to the server?
from appsensor.
Add users to the server from what perspective? Do you mean users as in users that are causing events? If so, they are automatically tracked. If not, let me know what you mean.
from appsensor.
Yes let us say to report an event i use username bob should i add some config to the server config file to allow this?
from appsensor.
No, that'll be picked up automatically. What you'd have to add config for are "client applications", ie. the application "name" that is sending you events. So, the application named "myclientapp" is sending an event that "bob" triggered (while using "myclientapp").
If you want to use another client app, you'd need to configure that, so that appsensor knows what client applications to allow requests from.
from appsensor.
Ok thanks so much for the amazing responses from you.
from appsensor.
Absolutely - thank you for helping us track down a bug.
from appsensor.
Related Issues (20)
- Error: While performing step 6 Start REST Client Data Generator HOT 3
- Error: while building appsensor ui HOT 2
- Error: Exception in UI when attacks should be displayed/are created HOT 3
- Bug in org.owasp.appsensor.storage.jpa2.dao.AttackRepository
- Dependency check version outdatet --> 404 on NVD
- org.hibernate.LazyInitializationException when running sample app and ui
- 204 no content as response to events
- Looking for instructions to run the sample app with AppSensor UI with docker compose
- Custom detection points are not looked up for possible responses HOT 1
- Using AppSensor with my C# ASP.NET Web application HOT 19
- MySQL setup script not working? HOT 5
- appsensor-ui cannot connect to database. HOT 4
- Q: Production ready? HOT 3
- appsensor-ui view by user and detection points fails HOT 5
- simple-dashboard earliest HOT 1
- org.owasp.appsensor.core.IPAddress does not work properly HOT 3
- Error when using REST API (page requires sending configured client header) HOT 2
- How to edit the login page HOT 4
- Explain the configuration difference between ws-rest-server-boot & ws-rest-server-boot-rules HOT 8
- Difficulties understanding the non-local AppSensor implementations HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from appsensor.