Undertow subsystem filter-ref does not resolve property expression for the predicate attribute in JBoss EAP 7

Environment

• Red Hat JBoss Enterprise Application Platform (EAP) 7.x

Issue

Undertow subsystem should support the property expression for the predicate attribute of <filter-ref>. However, it does not resolve and expand the specified property expression.

For example, I have the following configuration:

  <subsystem xmlns="urn:jboss:domain:undertow:10.0" ...>
      ...
      <server name="default-server">
          ...
          <host name="default-host" alias="localhost">
              ...
              <filter-ref name="request-limit-filter" predicate="not path-prefix('/${env.FOOBAR}/healthcheck')"/>
              <filter-ref name="dump-request-filter" predicate="path-prefix('/${my.predicate.path.test}')"/>
          </host>
      </server>
      ...
      <filters>
          <request-limit name="request-limit-filter" max-concurrent-requests="10" queue-size="1"/>
          <expression-filter name="dump-request-filter" expression="dump-request"/>
      </filters>
  </subsystem>

Then, JBoss EAP 7 starts with the following environment variable and system property:

FOOBAR=example ./bin/standalone.sh -Dmy.predicate.path.test=test

However, the dump-request filter does not trigger even if I send a request to http://localhost:8080/test/ and the request-limit filter also affects http://localhost:8080/example/healthcheck.

Resolution

This is a bug that is reported as This content is not included.JBEAP-20356 and has been fixed in JBoss EAP 7.3.4.

As a workaround until EAP 7.3.4 is released, you can use <expresion-filter> and specify a predicate part inside the expression instead of using the predicate attribute of <filter-ref>. For example:

  <subsystem xmlns="urn:jboss:domain:undertow:10.0" ...>
      ...
      <server name="default-server">
          ...
          <host name="default-host" alias="localhost">
              ...
              <filter-ref name="dump-request-filter"/> <!-- remove predicate from filter-ref -->
          </host>
      </server>
      ...
      <filters>
          <!-- add predicate part path-prefix('...') to expression -->
          <expression-filter name="dump-request-filter" expression="path-prefix('/${my.predicate.path.test}') -> dump-request"/>
      </filters>
  </subsystem>

Note that we can not use <expression-filter> as a workaround in some cases. For example, the request-limit expression does not support all configurable parameters that the <request-limit> filter supports. (e.g. queue-size can not be specified to the request-limit expression.) In such a case, this workaround can not be used.

If you still do not want to hard code the path to the predicate of <filter-ref> for <request-limit> filter, you can use regex instead of path-prefix. This can match various paths. For example:

<filter-ref name="request-limit-filter" predicate="not regex('/(.*?)/healthcheck')"/>

<filter-ref name="request-limit-filter" predicate="not regex('/([a-zA-Z0-9]+?)/healthcheck')"/>

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.