PK16893: WEBSECURITYEXCEPTION: INVALID URI PASSED TO SECURITY COLLABORATOR WHEN THE PATHINFO IS NULL IN THE REQUEST.

PK16893; 6.0.2.3: websecurityexception: invalid URI passed to collaborator

APAR status

• Closed as program error.

Error description

• When global security is enabled servlets returns 403/401
  response codes either sporadically or consistently.
  WebSecurityException: Invalid URI passed to Security
  Collaborator when the pathinfo is null in the request.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All WebSphere Application Server users who   *
  *                 have enabled security and using              *
  *                 servlet mapping.                             *
  ****************************************************************
  * PROBLEM DESCRIPTION: In servlet request there is a problem   *
  *                      with the second and any subsequent      *
  *                      request is that no longer               *
  *                      "/" is added by the web component.      *
  *                                                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  In servlet request there is a problem with the second and any
  subsequent request is that no longer "/" is added.
  
  The first request gets a / appended  even if no / is
  submitted. Every following request does not get this slash
  appened. The resulting "empty" URI causes an incorrect 403
  response code to be returned by WebSphere.
  

Problem conclusion

• Fixed the code as per Servlet 2.4 specification. If there is no
  servletpath or pathInfo, Security should pass in a "/"  to the
  security check.
  
  The fix for this APAR is currently targeted for inclusion in
  fixpack 6.0.2.7. Please refer to the Recommended  Updates page
  for delivery dates:
  http://www-1.ibm.com/support/docview.wss?rs=180&context=SSEQTP&
  uid=swg27004980
  

Temporary fix

• Sent a testfix
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PK16987

Modules/Macros

• SECURITY
  

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R60A PSY

     UP

• R60H PSY

     UP

• R60I PSY

     UP

• R60P PSY

     UP

• R60S PSY

     UP

• R60W PSY

     UP

• R60Z PSY

     UP