am getting this error when i try to access the appsensor rest api. I am using the spring boot version about appsensor

[ProZachJ]

Does this occur at startup or when you send a request to the server?

On Oct 25, 2015, at 7:11 AM, shreyasdn [email protected] wrote:

05:04:00.216 [http-nio-8085-exec-4] ERROR o.g.j.s.ServerRuntime$Responder - An I
/O error has occurred while writing a response message entity to the container o
utput stream.
java.lang.IllegalStateException: The output stream has already been closed.
at org.glassfish.jersey.message.internal.CommittingOutputStream.setStrea
mProvider(CommittingOutputStream.java:146) ~[jersey-common-2.14.jar:na]
at org.glassfish.jersey.message.internal.OutboundMessageContext.setStrea
mProvider(OutboundMessageContext.java:798) ~[jersey-common-2.14.jar:na]
at org.glassfish.jersey.server.ContainerResponse.setStreamProvider(Conta
inerResponse.java:372) ~[jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime$Responder.writeResponse(Ser
verRuntime.java:606) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime$Responder.processResponse(S
erverRuntime.java:377) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime$Responder.process(ServerRun
time.java:420) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:27
7) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [jersey-
common-2.14.jar:na]
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [jersey-
common-2.14.jar:na]
at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [jersey
-common-2.14.jar:na]
at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [jersey
-common-2.14.jar:na]
at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [jersey
-common-2.14.jar:na]
at org.glassfish.jersey.process.internal.RequestScope.runInScope(Request
Scope.java:297) [jersey-common-2.14.jar:na]
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:
254) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHand
ler.java:1030) [jersey-server-2.14.jar:na]
at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:3
77) [jersey-container-servlet-core-2.14.jar:na]
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContaine
r.java:381) [jersey-container-servlet-core-2.14.jar:na]
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContaine
r.java:344) [jersey-container-servlet-core-2.14.jar:na]
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContaine
r.java:221) [jersey-container-servlet-core-2.14.jar:na]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:291) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52
) [tomcat-embed-websocket-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:239) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(
RequestContextFilter.java:99) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerR
equestFilter.java:107) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:239) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterIntern
al(CharacterEncodingFilter.java:85) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]

at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerR

equestFilter.java:107) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:239) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:219) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:106) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(Authentica
torBase.java:502) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:142) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:79) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:88) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:518) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp
11Processor.java:1091) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(
AbstractProtocol.java:673) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpo
int.java:1526) [tomcat-embed-core-8.0.26.jar:8.0.26]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoin
t.java:1482) [tomcat-embed-core-8.0.26.jar:8.0.26]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.
java:1142) [na:1.8.0_60]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor
.java:617) [na:1.8.0_60]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskTh
read.java:61) [tomcat-embed-core-8.0.26.jar:8.0.26]
at java.lang.Thread.run(Thread.java:745) [na:1.8.0_60]

Is there anyone who can help me solve this problem.

—
Reply to this email directly or view it on GitHub.

[ProZachJ]

Please make sure you are on the latest master. I'm pretty sure we made some POM changes recently to allow this server to boot correctly.

Here are the steps I just took to get it running. If this doesn't work for you I'll need more info to help you trouble shoot.

1. Clone latest master
2. Switch to sample-apps/appsensor-ws-rest-server-boot
3. Run mvn spring-boot:run

Here is the startup:

Here is an expected response:

[shreyasdn]

I get the above response but when I try through the rest api client with the application header set I get back no response and the above error. Both the rest server and the spring boot servers send the same response error. Let me know if you need more details will provide them.

[ProZachJ]

I was able to reproduce this by issuing a couple requests to the server, even without the header, the first request gets a proper response and then the second one errors out. Attempting to dig into it.

[ProZachJ]

Are you using the default header or setting a custom one via config?

[ProZachJ]

I found a way to resolve the issue that I'm seeing without any header, but the fix leads me to believe that the only way you should be seeing this error is if you aren't passing a header.

@jtmelton I'm not 100% on this yet but looking here:

appsensor/execution-modes/appsensor-ws-rest-server/src/main/java/org/owasp/appsensor/rest/filter/ClientApplicationIdentificationFilter.java

Line 38 in a3b37bb

private final static WebApplicationException unauthorized =

    private final static WebApplicationException unauthorized =
               new WebApplicationException(
                   Response.status(Status.UNAUTHORIZED)
                           .entity("Page requires sending configured client application identification header.").build());
    ...
        // Get the client application identifier passed in HTTP headers parameters
        String clientApplicationIdentifier = context.getHeaderString(HEADER_NAME);

        if (clientApplicationIdentifier == null) {
            throw unauthorized;
        }

        context.setProperty(RestRequestHandler.APPSENSOR_CLIENT_APPLICATION_IDENTIFIER_ATTR, clientApplicationIdentifier);
    }

You can see how a subsequent request without a header would cause the "unauthorized" error to be thrown. Looking at how this is written, being a final static, I believe the issue is that "Response" is getting reused causing the error. Similar to this example: dropwizard/dropwizard#893

As a test I changed the throw to look like this:

if (clientApplicationIdentifier == null) {
                throw new WebApplicationException(
                               Response.status(Status.UNAUTHORIZED)
                                       .entity("Page requires sending configured client application identification header.").build());
            }

This caused me to no longer trigger the IO exception when I send multiple requests without a header but I'm still unsure how this error could be trigged in the case that clientApplicationIdentifier !== null. I'm thinking I'll need to trace further down the request chain to see how the response is handled in those cases. Perhaps it is used off of the context causing a similar issue?

[jtmelton]

@shreyasdn thanks for catching this issue - I've not seen it before.

@ProZachJ thanks for jumping in and looking at the result. Yes, this is likely the (or at least an) issue. I should not have been caching the response. There is implicit state there, and it would cause caching issues on multiple requests. I agree I'm not sure how it could be triggered with if the appropriate authz header was sent, though.

I just pushed a change that should resolve this.

@shreyasdn please let me know if that change resolves this issue.

[shreyasdn]

@ProZachJ thanks a lot for replying so quickly and looking at the issue.
@jtmelton I tried the latest code for the spring boot server and i ran mvn spring-boot:run command but as @ProZachJ said the second response is still throwing the error i got earliar. I just downloaded the latest commit.

[jtmelton]

@shreyasdn Ok, is there any way you could send over your code/test case? I can't reproduce. I'm assuming you're using the spring boot rest server, and the rest api client - is that right? Could you send your client code?

[jtmelton]

@shreyasdn also, how are you starting up the server? What you should do after pulling the latest code is a 'mvn clean install' from the root appsensor directory (that'll install the rest-server changes I made as well as run the tests). After that, you can run 'mvn spring-boot:run' from the spring boot rest server directory.

[shreyasdn]

@jtmelton thanks that fixed the issue but why do i get a unauthorized for my request as i have configured to correct client auth header. Please find below the screenshot of my client. Can you tell me if i need to add any other headers?

[jtmelton]

@shreyasdn No that looks mostly right. Can you send me the url you were hitting, the verb (get/post) and the content you were sending?

The only thing I see in the screenshot that looks odd is the cookie. Looks like it's a google analytics cookie - that shouldn't be coming from our server. Ours would have a jsessionid cookie.

[shreyasdn]

i am hitting the url http://localhost:8085/api/v1.0/responses and using get verb and sending no content.

[jtmelton]

Ok, I'm using the "Advanced Rest Client" chrome app, and here is my config/response:

[jtmelton]

After looking, it appears the request header name and value in yours are quoted. Can you check that?

[shreyasdn]

Yes that was the issue and just another question how do i add users to the server?

[jtmelton]

Add users to the server from what perspective? Do you mean users as in users that are causing events? If so, they are automatically tracked. If not, let me know what you mean.

[shreyasdn]

Yes let us say to report an event i use username bob should i add some config to the server config file to allow this?

[jtmelton]

No, that'll be picked up automatically. What you'd have to add config for are "client applications", ie. the application "name" that is sending you events. So, the application named "myclientapp" is sending an event that "bob" triggered (while using "myclientapp").

If you want to use another client app, you'd need to configure that, so that appsensor knows what client applications to allow requests from.

[shreyasdn]

Ok thanks so much for the amazing responses from you.

[jtmelton]

Absolutely - thank you for helping us track down a bug.