[SLING-11825] SlingHttpServletRequestImpl.getUserPrincipal() does not return null for anonymous requests

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Engine 2.14.0
• Fix Version/s: Engine 2.15.0
• Component/s: Engine
• Assignee: Konrad Windszus
• Reporter: Konrad Windszus
• Created: 12/Apr/23 09:47
• Updated: 20/Jul/23 10:17
• Resolved: 14/Apr/23 07:52

Description

According to https://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getUserPrincipal() the method getUserPrincipal is supposed to return

null if the user has not been authenticated

Unfortunately the implementation in https://github.com/apache/sling-org-apache-sling-engine/blob/c31e3ad64cafa0e53f67ad7551b13dc7124ccff6/src/main/java/org/apache/sling/engine/impl/SlingHttpServletRequestImpl.java#L320 seems to violate this contract, as I always get back a non-null value (even if the user was never authenticated).

The ResourceResolver.adaptTo(Principal.class) will always return a non-null value due to https://github.com/apache/sling-org-apache-sling-jcr-resource/blob/685c50921085941f4cbb1a3ccdbf90bad0605527/src/main/java/org/apache/sling/jcr/resource/internal/helper/jcr/JcrResourceProvider.java#L617

Issue Links

• breaks: SLING-11974 Regression caused by SLING-11825 - change in request getUserPrincipal
• links to: GitHub Pull Request #33