[WW-2769] Default RolesInterceptor not well suited @portlet environment, sending 403 is forbidden in portlets

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 2.0.11.2
• Component/s: Core Interceptors, Plugin - Portlet

Environment

Linux 2.6.x, Pluto 1.1.6 & Tomcat 6.0.18

• Assignee: Unassigned
• Reporter: Torsten Krah
• Created: 15/Aug/08 11:04
• Updated: 17/Oct/22 05:25
• Resolved: 17/Oct/22 05:25

Description

The default RolesInterceptor does handle a forbidden request in the handleRejection method with a 403 Error.
However, sending a 403 directly to the request back to the user is forbidden in a portlet.
The default RolesInterceptor implementation does not handle this very well.

A workaround is to override the handleRejection method of the RolesInterceptor (and using this one instead of the default) which does throw a custom exception, which is handled by a global-exception definition which sent the user to a custom error page displaying a forbidden message.

Issue Links

• relates to: WW-2095 Changing portlet mode after validation errors fails