[ACE-511] ScriptServlet does not apply security

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.0.1
• Fix Version/s: 2.1.0
• Component/s: Authentication
• Labels: ace-next-security
• Environment: n/a
• Assignee: J.W. Janssen
• Reporter: Sander Mak
• Created: 22/Jan/15 16:10
• Updated: 28/Jan/16 10:50
• Resolved: 28/Jan/16 10:50

Description

Looking at the sourcecode, authentication on endpoints is enforced by calling AuthenticationService from the servlet's service() methods. However, the ScriptServlet (executing arbitrary Gogo scrips) does not call this service.

I'm not sure what the rationale is for not using an HttpContext and/or Servlet filter to enforce authentication on all endpoints, but that would have prevented this situations from arising...

Issue Links

• is broken by: ACE-460 Provide a way to automate client access to an ACE server using a script