Critical Description
We're busy with a project to replace every page in our application with a newer version. We don't want to break existing bookmarks, but we also don't want to have untested new pages in production. As a solution, all our new pages are only accessible via a feature toggle.
A simplified version looks like:
SimplePage.html
<!DOCTYPE html> <html xmlns:wicket="http://wicket.apache.org"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <title></title> </head> <body> <div wicket:id="label"></div> </body> </html>
SimplePage.java
public class SimplePage extends WebPage { public SimplePage() { super(); } }
OldPage.java
public class OldPage extends SimplePage { public OldPage() { } @Override protected void onInitialize() { super.onInitialize(); add(new Label("label", "OldPage")); } }
NewPage.java
public class NewPage extends SimplePage { public NewPage() { if (featureFlagDisabled()) { // new page is not ready yet, show users the old page throw new RestartResponseException( new PageProvider(OldPage.class), RedirectPolicy.NEVER_REDIRECT ); } } private boolean featureFlagDisabled() { return true; } @Override protected void onInitialize() { super.onInitialize(); add(new Label("label", "NewPage")); } }
And in our application class:
mountPage("page1", NewPage.class);
mountPage("page2", OldPage.class);
getCspSettings()
.blocking();
The url 'page1' is known to our users. The url 'page2' is not known to our users. Besides ending up with outdated bookmarks, there's no harm if they would access it directly.
Regardless of which url you open, the RestartResponseException ensures the reponse in the browser is always 'OldPage'.
However, the CSP is not included if wicket performs the internal redirect. If I open the url 'page2' directly, the result does include a CSP. See attached screenshots.
A workaround for this issue is a client side redirect; but then the users would see the url change.
Attachments
Attachments
Issue Links
- is related to
-
WICKET-7107 CSP Header not rendered when using RedirectPolicy.AUTO_REDIRECT
-
- Open
-
- links to