[CXF-4234] JAX-RS JAASAuthenticatingFilter leaks SecurityException

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.5.3, 2.6
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Sergey Beryozkin
• Created: 10/Apr/12 14:09
• Updated: 23/Apr/12 16:45
• Resolved: 10/Apr/12 14:10

Description

JAASAuthenticatingFilter is a wrapper around JAASLoginInterceptor and is supposed to return 401 in case of the missing HTTP Authorization header or failed logins. At the moment it leaks SecurityException that JAASLoginInterceptor throws in case of missing (Basic) authorization data which results in the browser reporting 500 instead of popping up the Authenticate window