Amazon SQS Listener on Spring Boot calling REST endpoint fails with "Are you referring to request attributes outside an actual web request" - spring

I have an Amazon SQS Listener configured in a Spring Boot application. After receiving a message of the queue, it has to call a REST API.
The call fails with this error
java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally receiving thread? If you are actually operating within a web request and still receive this message, your code is probably running outside of DispatcherServlet: In this case, use RequestContextListener or RequestContextFilter to expose the current request.
at org.springframework.web.context.request.RequestContextHolder.currentRequestAttributes(RequestContextHolder.java:131)
The REST Template is trying to read some attributes off the RequestContextHolder and it doesn't have the Web context. Unfortunately, I don't have access to the Rest template to change it (it is in a library).
What can I do in this case?

Related

Provide Response to user who call the RestApi without waiting for the microservice rest call using spring boot

I am developing a web API for an application. I had got a situation where the user will send a few data to my API. After processing the data I have to forward a few data to other API.
But I don't want to concentrate on the response from the second API to where I had called.
After calling the second API I want to send my response to the user without waiting for the second API response.
Can anyone tell me how to handle this situation?
My API is written in JAVA spring boot REST, The Second API to where am calling is in PYTHON.
#Async will make it execute in a separate thread, i.e. the caller will not wait for the completion of the called method.
Limitations
it must be applied to public methods only
self-invocation – calling the async method from within the same class
– won’t work
Example:
Spring Doc, Example 1, Example 2

spring-boot rest application on weblogic

I have a spring boot rest application working fine on Tomcat.
My goal was to deploy the same on weblogic. I have followed the steps mentioned on spring site here
I don't have a web.xml file in the project.
After deployment I ran into this error.
java.lang.IllegalStateException: No thread-bound request found:
Are you referring to request attributes outside of an actual web request,
or processing a request outside of the originally receiving thread? If you are actually operating with
in a web request and still receive this message, your code is probably running outside
of DispatcherServlet/DispatcherPortlet: In this case, use RequestContextListener
or RequestContextFilter to expose the current request.
at org.springframework.web.context.request.RequestContextHolder.currentR
equestAttributes(RequestContextHolder.java:131) ~[spring-web-4.3.13.RELEASE.jar:
4.3.13.RELEASE]
The same requests work fine in tomcat. I am not sure if I need to include a web.xml file with ContextLoaderListener. But I wonder how it's not a problem in tomcat container.

Spring Security - Method level security and non-authenticated invocations

I have a vanilla Spring Boot application that consists of a controller, a service and a DAO layer. The controller code calls the service code and so on.
To implement some semblance of security, I am currently using Spring Security 4.0.x's global method security annotations in combination with Spring Security ACL to lock down my service methods.
Requests that go through my controllers are auth-ed and authorized just fine because a principal / user is in context. HOWEVER, I also have some additional non-user facing code that listens for messages from an AWS queue. Within this listener code I invoke some secured services (to stay DRY and not duplicate business logic) but for this situation no user is in scope.
Generally speaking:
For a situation like the one I'm describing, what is a good / acceptable way to authenticate user-less method invocations e.g. ones that don't come through an HTTP request (or to bypass the check)? I am considering manually setting the SecurityContextHolder with a "system user" in my message listener code but this has some code smell.
Is method level security better applied at the controller level?

How to access request object in #MessageMapping method with spring websocket implementation

I am integrating an existing spring MVC web application with spring websockets. I was successfully able to integrate by following the instructions in
https://spring.io/guides/gs/messaging-stomp-websocket/
The existing web application has a filter, which sets a few of the attributes. I have a requirement to access the attributes set by the filter in the controller i,e in #MessageMapping method.
Could some one tel how can we access the request object in the #MessageMapping method?
When a STOMP client connects to the application, it first has to request a protocol upgrade to switch to websocket. Once using that websocket connection, the messages sent/received don't go through your regular Servlet filter - only the first HTTP request (the "Handshake") did.
Depending on your use case, there are several ways to achieve this.
If it's related to Authentication, then there are existing features for this in the Spring Framework, but also in Spring Security.
If it's related to the HTTP session, you can easily ask for all HTTP session attributes to be copied into the websocket session - or even customize the Handshake for your own needs (see reference doc). Once done, you can inject the Websocket scope in a #MessageMapping controller method and get those attributes (see reference doc).

Need to render WCM content from an Asynch bean

I'm trying to get rendered WCM content in an Asych bean (which implements the Work interface). I can create a Workspace using a username and password, but I don't see an API to create a RenderingContext without passing either a portlet request/response or a servlet request/response pair).
Is there any way I can either 1) Create a RenderingContext without a portlet or servlet request and response, or 2) Render WCM content in an asynchronous work bean some other way?
I'm using IBM Web Content Management, WebSphere Portal and WAS versions all at versions 6.1.x.
According to the API you can't get a RenderingContext without a ServletRequest or PortletRequest. You might need to make an http request back to the WCM servlet or write a web service that use the WCM API.

Resources