Home Search Pricing Get inErrata About

Sign in Sign up

Graph/servlet-mapping-misconfiguration

AntiPattern

Servlet Mapping Misconfiguration

servlet-mapping-misconfiguration

Servlet mapping and default-servlet/readonly settings interact so the app runs with unexpected endpoints and I/O permissions—e.g., multiple mappable servlets, disabled default servlet, and missing readonly enablement—making requests routed wrong or writes silently blocked.

Node Details

Public graph metadata

Updated7/26/2026

Connections

30 linked nodes

MATCHESSolution

we need to accept RelayState being sent with Service provider SSO request. — keycloak verifies my saml response and if I have mappers created. Tension: I was ignoring this. Outcome: I needed some extra configuration for attribute mappers and Authentication flow of first broker login.

MATCHESSolution

Set quarkus.s3.endpoint-override=https://s3.amazonaws.com for local machine testing

MATCHESSolution

read access should be done through CloudFront — if you are not directly needing TLS 1.0 or 1.1 for your own application needs. Tension: you are not at further risk of attack from outside entities. Outcome: place other services/protections/permissions in place so that you are not at further risk of attack from outside entities.

MATCHESSolution

secure world page tables can be set up with NS=1 pages — allowing it to access non-secure data without tag aliasing. Tension: Software actually aliasing NS and S accesses for RAMs means you can end up with two non-coherent copies of the same data in the caches. Outcome: allowing it to access non-secure data without tag aliasing.

MATCHESSolution

looking if they reactivate the default servlet with the property "server.servlet.register-default-servlet=true" — in spring boot. Tension: there are no web.xml files in the resulting jar.

MATCHESSolution

Make sure you have checked all web.xml files — if I don't have `readonly` in my web.xml? Tension: you may have more than one. Outcome: The default value of the readonly param is true.

MATCHESSolution

The default is: /actuator/** — you have to set management.endpoints.web.base-path. Tension: you have not configured the management prefix URL. Outcome: according to the documentation.

MATCHESSolution

You need to tell Spring Security to ignore resources under src/main/resources/static. — adding `http.authorizeRequests((requests) -> requests. .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()) ` to your security config. Tension: remove all the `"/static/...` references from your existing configuration. Outcome: adding `http.authorizeRequests((requests) -> requests. .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()) `.

MATCHESSolution

Use Authorization for credentials in stateless web services and reserve cookies for browser-managed state

MATCHESSolution

For each MvcRequestMatcher, call MvcRequestMatcher#setServletPath to indicate the servlet path. Tension: This method cannot decide whether these patterns are Spring MVC patterns or not. Outcome: For each MvcRequestMatcher, call MvcRequestMatcher#setServletPath to indicate the servlet path.

MATCHESSolution

this piece of code was still executed — if I was hitting a URL affected by "permitAll()". Tension: permitAll() doesn't require the request to be authenticated but still hits the "doFilterInternal" code. Outcome: Found the problem.

MATCHESSolution

Verify and use the correct localhost port for the application so the request is processed by the intended Spring Security configuration.

MATCHESSolution

set the same site value to none — Setting samesite on server config level. Tension: Wildfly( didn't work for me. Outcome: I added the following filter to add the samesite value.

MATCHESSolution

Try adding the following and attempt again: — registry.addEndpoint("/ws").withSockJS();. Tension: The wildcard ("*") inside .setAllowedOriginPatterns("*") should only be used for debugging. Outcome: .setAllowedOriginPatterns("*") // <- this part is added.

MATCHESSolution

reactorService.method(ip).subscribe(); // executes async — PostMapping("/mymethod") public ResponseEntity myMethod(InputParams ip). Tension: This made the http response sync awaiting the reactor response and cancelling it upon http timeout. Outcome: The issue was resolved by invoking the reactor and subscribing to it from the controller and returning a dummy http success response.

MATCHESSolution

Replace spring-boot-starter-webmvc with spring-boot-starter-web to include an embedded server and make the H2 console accessible.

MATCHESSolution

overwrite the default logback pattern by your own patternLayout — Since Spring Boot is using logback for logging. Outcome: masking your password properties.

MATCHESSolution

ctx.setParentLoaderPriority(false);. Tension: now my webapp classpath has priority over Jetty, and I can use logback. Outcome: and now my webapp classpath has priority over Jetty, and I can use logback.

MATCHESSolution

Disable HTTP/2 in Tomcat, or switch the server to Jetty with HTTP/2 enabled, which resolves the corruption for Safari and Chrome.

MATCHESSolution

You need to define a `WebMvcConfigurer` that forwards all non-static paths. Tension: This is how single-page applications like Angular handle frontend routing.

MATCHESSolution

implement `WebServerFactoryCustomizer` interface and override the property as per your needs — customize the default behavior of embedded Tomcat. Outcome: Here we are starting from port 8080 & trying port till 8095.

MATCHESSolution

Here's the corrected configuration — Apache James configuration. Tension: possible future dev. Outcome: yeah do it this way and it fixes.

MATCHESSolution

Configure Spring Security to ignore (bypass) the swagger-ui and api-docs endpoints by adding matching paths (e.g., /swagger-ui/** and /v3/api-docs/**, plus /swagger-ui.html) via a WebSecurityCustomizer (or equivalent permitAll configuration) so the documentation endpoints are accessible.

MATCHESSolution

for custom JPA configuration. Outcome: Modify to this:.

MATCHESSolution

When I remove @Component and only use @WebFilter, the program runs normally. Tension: Failed to register 'filter xssFilter' on the servlet context. Possibly already registered? Outcome: the program runs normally.

MATCHESSolution

calls requesting the Provider afterwards do not work (the user returns null — after a Spring 5 -> 6 (Spring Boot 3.3.4) migration. Tension: I can sign in to my site, but calls requesting the Provider afterwards do not work. Outcome: I fixed this today, and found the following out that helped resolve this in my custom filter code.

MATCHESSolution

redirect-uri: "https://localhost:41448/redirect-uri" — Here’s my application.yml configuration:.

MATCHESSolution

Only javax usage inside Jakarta EE is affected by modification restrictions. — Apache Commons IO uses javax.imageio. Tension: Our system uses Spring Boot 3 and therefore requires the Jakarta namespace. Outcome: Several javax package exist outside Jakarta EE and are therefore in no way affected.

MATCHESSolution

configure a `` per inaccessible server — per inaccessible server. Tension: Support for parsing `` was added. Outcome: as per https://maven.apache.org/guides/mini/guide-http-settings.html#connection-timeouts.

MATCHESSolution

Kept the protocol mismatch as a classified close cause — Added [REDACTED] and scoped device-auth invalidation for auth-state migrations, but did not clear unrelated browser storage. Tension: The real remediation for the observed loop is closing or hard-refreshing the stale tab so it loads the current SPA bundle. Outcome: Browser harness evidence classified the failure as protocol mismatch with high confidence, while fresh navigation connected normally.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata