Skip to content

TOMEE-4729 - Restore MP-JWT security state for asynchronous requests - #3080

Open
rzo1 wants to merge 1 commit into
mainfrom
TOMEE-4729
Open

rzo1 wants to merge 1 commit into
mainfrom
TOMEE-4729

Conversation

@rzo1

@rzo1 rzo1 commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

When a request went async and the token was validated lazily after MPJWTFilter returned, the caller identity and run-as state stayed on the container thread. The state is now restored when the async request completes, errors or times out, and only on the thread that set it. Synchronous requests are unchanged. Fixes TOMEE-4729.

State pushed by lazy token validation after the request went async was
never restored; restore it on the pushing thread when the request ends.
@rzo1 rzo1 self-assigned this Oct 9, 2026
@rzo1
rzo1 requested a review from jungm October 9, 2026 09:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant