WebSphere Application Server & Liberty

 View Only
Expand all | Collapse all

WebSphere application security enabled - restriction on HTTP Methods does not work as expected

  • 1.  WebSphere application security enabled - restriction on HTTP Methods does not work as expected

    Posted Fri February 09, 2024 11:06 AM

    Hello,

    On IBM WebSphere Application Server 9.0.5.14 in Global Security we select "Enable application security option" and would like restrict certain HTTP methods at application level for concrete deployed applications via the following stanza in application descriptor /WEB-INF/web.xml

        <security-constraint>
            <web-resource-collection>
                <web-resource-name>restricted methods</web-resource-name>
                <url-pattern>/*</url-pattern>
                <http-method>COPY</http-method>
                <http-method>LOCK</http-method>
                <http-method>MKCOL</http-method>
                <http-method>MOVE</http-method>
                <http-method>PROPFIND</http-method>
                <http-method>PROPPATCH</http-method>
                <http-method>UNLOCK</http-method>
                <http-method>TRACE</http-method>
            </web-resource-collection>
            <auth-constraint/>
        </security-constraint>
        <security-constraint>
            <web-resource-collection>
                <web-resource-name>restricted methods 2</web-resource-name>
                <url-pattern>/css/*</url-pattern>
                <url-pattern>/fonts/*</url-pattern>
                <url-pattern>/images/*</url-pattern>
                <url-pattern>/js/*</url-pattern>
                <http-method>PUT</http-method>
                <http-method>PATCH</http-method>
                <http-method>DELETE</http-method>
                <http-method>COPY</http-method>
                <http-method>LOCK</http-method>
                <http-method>MKCOL</http-method>
                <http-method>MOVE</http-method>
                <http-method>PROPFIND</http-method>
                <http-method>PROPPATCH</http-method>
                <http-method>UNLOCK</http-method>
                <http-method>TRACE</http-method>
            </web-resource-collection>
            <auth-constraint/>
        </security-constraint>

    This configuration works perfectly on other application servers (Tom Cat / WebLogic) but on WebSphere we are facing unexpected behavior that we cannot resolve - despite HTTP PATCH method is blocked for only concrete URL patterns we receive "HTTP 403 Forbidden" for any URL, i.e. for URL that does not match the configured "url-pattern"-s. For ex. we get "HTTP 403" for PATCH request to 

       <app context>/api/be/password/changePassword

    that definitely don't match url-patterns in web.xml (and that is well served on all other app servers we deploy the same web.xml). 

    If we remove the security-constraint sections above from web.xml HTTP PATCH works well. We do this test by directly accessing WebSphere on its HTTP interface, there is no other HTTPD upfront it. 

    What is even more unusual is that with this security-constraints in web.xml for a single application deployed on WAS HTTP PATCH become blocked with HTTP 403 for all other deployed applications (with different context), when we expect that the scope of these security constrains should be only the context of the particular application that has these into its web.xml

    Can one give a hint what do we do wrong, considering that this technique to restrict HTTP methods on WAS is exactly what we find in IBM documentation

    Thanks in advance,

    George 



    ------------------------------
    george serdaroff
    ------------------------------