I use WildFly 16 and am doing some experiment on Java EE 8 Security API. I have a JAX-RS endpoint like this (with some definition in web.xml, jboss-web.xml):
@Path("/secured")
public class SecuredResource {
@Inject
private SecurityContext securityContext;
@GET
@Path("/greet")
@RolesAllowed({"USER"})
@Produces(MediaType.TEXT_PLAIN)
public Response greet() {
return Response.ok().entity("Hello " + securityContext.getCallerPrincipal().getName()).build();
}
}
As I expected, requests which don't have the "USER" role don't reach the code there but those requests get http responses with the code 200. I want to return "401 Unauthorized" for those requests, not 200.
According to some document of RESTEasy, it's supposed to behave like that:
How does Resteasy do authorization? Well, its really simple. It just sees if a method is annotated with @RolesAllowed and then just does HttpServletRequest.isUserInRole. If one of the @RolesAllowed passes, then allow the request, otherwise, a response is sent back with a 401 (Unauthorized) response code.
But it's not like that in my case. How can I make it work that way?
This is the whole project of my experimental implementation. It also has a test case which shows my expectation. It can run with ./mvnw clean verify
