Details
-
Improvement
-
Status: Closed
-
Major
-
Resolution: Fixed
-
Engine 2.1.0
-
None
Description
Currently the Sling Engine supports javax.servlet.Filter services with or without service registration properties but explicitly ignores Filter services with the "pattern" property set. This is suboptimal and may lead to false positives.
The scope of registered filters can be configured with an optional property filter.scope set to "request" (the default if the property is not set) or "component" (as of SLING-1213 further values are supported).
This setup should be modified as follows:
- The property name "filter.scope" is deprecated but still supported for backwards compaitiblity
- A new property "sling.filter.scope" is defined which is required for a javax.servlet.Filter to be accepted
The new property is introduced to minimize the change of a property name collision with other consumers of javax.servlet.Filter services which might (theoretically) define the same property.
By default javax.servlet.Filter services without either the sling.filter.scope or the old filter.scope property set will be ignored. This can be overwritten by a configuration option of the Sling Main Servlet component to still accept filters without any of the two properties.
See also the discussion at http://markmail.org/message/quxhm7d5s6u66crr