[OpenNMS/opennms] 944fe9: NMS-20174: Fix Vue menu not rendering in Safari/Fi...

  Branch: refs/heads/jira/NMS-20174-menu-issues-in-ff-and-safari-smoke
  Home:   https://github.com/OpenNMS/opennms
  Commit: 944fe96a34d3a43c4bffae28b268a222dc95894a
      https://github.com/OpenNMS/opennms/commit/944fe96a34d3a43c4bffae28b268a222dc95894a
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-06 (Thu, 06 Aug 2026)

  Changed paths:
    M opennms-webapp/src/main/webapp/WEB-INF/applicationContext-spring-security.xml
    M opennms-webapp/src/main/webapp/includes/bootstrap.jsp

  Log Message:
  -----------
  NMS-20174: Fix Vue menu not rendering in Safari/Firefox on JSP pages

Two related fixes:

1. Allow anonymous access to /ui-components/** (the Vue menu bundle's
   static js/css/fonts). bootstrap.jsp preloads these assets from the
   login page; the unauthenticated request was 302-redirected to
   login.jsp, and Safari/Firefox cached that text/html response under
   the asset URL. After login, the module script was then refused
   ('text/html' is not a valid JavaScript MIME type), so the menu never
   mounted and only the :empty CSS skeleton background was visible.
   Chrome refetches instead of trusting the cached redirect, which
   masked the bug there.

2. Honor the Bootstrap 'quiet' flag (in addition to the 'quiet' include
   param) when deciding whether to emit the Vue menu container/script.
   login.jsp sets quiet via Bootstrap.flags("quiet") only, so the menu
   script was always emitted there and, once the assets became
   anonymously loadable, executed unauthenticated on the login page.
   Its REST calls triggered the browser's native basic-auth prompt and
   poisoned SPRING_SECURITY_SAVED_REQUEST with a REST URL, which the
   password gate's Skip button then redirected to - downloading a
   zero-byte file named 'rest' instead of navigating to index.jsp.


  Commit: a04fc9bb77d16cccf9baf42e0cd81909a6cc7011
      https://github.com/OpenNMS/opennms/commit/a04fc9bb77d16cccf9baf42e0cd81909a6cc7011
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-06 (Thu, 06 Aug 2026)

  Changed paths:
    M features/springframework-security/src/main/java/org/opennms/web/springframework/security/LoginModuleUtils.java
    A features/springframework-security/src/test/java/org/opennms/web/springframework/security/LoginModuleUtilsTest.java

  Log Message:
  -----------
  NMS-20174: Never use saved REST/API requests as post-login redirect target

Defense-in-depth for the password gate Skip bug: if a REST/API XHR is
captured in SPRING_SECURITY_SAVED_REQUEST (e.g. it fired while the
session was unauthenticated), redirecting the browser to it top-level
after login downloads the response as a file instead of showing a page.
isInvalidSavedRequestUrl() now rejects /rest and /api servlet paths in
addition to the existing asset suffixes, so both consumers
(OpenNMSAuthSuccessHandler and PasswordGateActionServlet) fall back to
/index.jsp. Adds unit test coverage for the guard.


Compare: https://github.com/OpenNMS/opennms/compare/944fe96a34d3%5E...a04fc9bb77d1

To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs