{"action":"created","comment":{"url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/comments/197624202","pull_request_review_id":131407384,"id":197624202,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDE5NzYyNDIwMg==","diff_hunk":"@@ -142,15 +125,66 @@ protected void doFilterInternal(final HttpServletRequest request, final HttpServ\n             logger.debug(\"CORS Processing request: \"+getRequestInfo(request));\n         }\n         if (isXhrRequest(request)) {\n-            handleRequest(request, response, filterChain, getXhrConfiguration());\n+            handleRequest(request, response, filterChain, resolveXhrCorsConfiguration());","path":"server/src/main/java/org/cloudfoundry/identity/uaa/security/web/CorsFilter.java","position":53,"original_position":53,"commit_id":"5264e52efd526fb696940b37657a8d82c4d8febe","original_commit_id":"5264e52efd526fb696940b37657a8d82c4d8febe","user":{"login":"DennisDenuto","id":2989269,"node_id":"MDQ6VXNlcjI5ODkyNjk=","avatar_url":"https://avatars2.githubusercontent.com/u/2989269?v=4","gravatar_id":"","url":"https://api.github.com/users/DennisDenuto","html_url":"https://github.com/DennisDenuto","followers_url":"https://api.github.com/users/DennisDenuto/followers","following_url":"https://api.github.com/users/DennisDenuto/following{/other_user}","gists_url":"https://api.github.com/users/DennisDenuto/gists{/gist_id}","starred_url":"https://api.github.com/users/DennisDenuto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DennisDenuto/subscriptions","organizations_url":"https://api.github.com/users/DennisDenuto/orgs","repos_url":"https://api.github.com/users/DennisDenuto/repos","events_url":"https://api.github.com/users/DennisDenuto/events{/privacy}","received_events_url":"https://api.github.com/users/DennisDenuto/received_events","type":"User","site_admin":false},"body":"Hi @Bitty9 thanks for the reply. I suppose its my turn to apologize for the late reply (this must have gotten lost when i went on vacation). Anyhoo, my concern actually is *not* on the `initialize` method. However it is for the `doFilterInternal` method. \r\n\r\nSpecifically, if two identical requests are made in parallel, and if both of these requests reach this filter at the same time, then it seems to me that there is a data race condition problem here. \r\n\r\ni.e. \r\n\r\nTime | Req 1 | Req 2 | notes\r\n------------ | ------------- | ------------- | -------------\r\n0 | reaches filter | reaches filter | \r\n1 | clears out the patterns zoneXhrConfiguration.getAllowedUriPatterns().clear(); | |\r\n2 | compileCorsAllowedPatterns | |\r\n3 | | clears out the patterns zoneXhrConfiguration.getAllowedUriPatterns().clear();  |\r\n4 | handleRequest with cors filter (refer to notes column)  | | Problem is here because I think the cors filter is now empty because of req 2 \r\n5 | | compileCorsAllowedPatterns |\r\n6 | | handleRequest with cors filter |\r\n\r\nAlso a reminder that there are also 2 failing tests:\r\n```\r\norg.cloudfoundry.identity.uaa.mock.DefaultConfigurationTestSuite > org.cloudfoundry.identity.uaa.mock.limited.LimitedModeLoginMockMvcTests.testXhrCorsPolicyforNonDefaultZone FAILED\r\n    java.lang.AssertionError: Status expected:<200> but was:<403>\r\norg.cloudfoundry.identity.uaa.mock.DefaultConfigurationTestSuite > org.cloudfoundry.identity.uaa.login.LoginMockMvcTests.testXhrCorsPolicyforNonDefaultZone FAILED\r\n    java.lang.AssertionError: Status expected:<200> but was:<403>\r\n```\r\n\r\nAre you able to reproduce these failing tests locally on your machine?\r\n","created_at":"2018-06-23T22:44:16Z","updated_at":"2018-06-23T22:44:17Z","html_url":"https://github.com/cloudfoundry/uaa/pull/806#discussion_r197624202","pull_request_url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/806","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/comments/197624202"},"html":{"href":"https://github.com/cloudfoundry/uaa/pull/806#discussion_r197624202"},"pull_request":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/806"}},"in_reply_to_id":188499117},"pull_request":{"url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/806","id":183197006,"node_id":"MDExOlB1bGxSZXF1ZXN0MTgzMTk3MDA2","html_url":"https://github.com/cloudfoundry/uaa/pull/806","diff_url":"https://github.com/cloudfoundry/uaa/pull/806.diff","patch_url":"https://github.com/cloudfoundry/uaa/pull/806.patch","issue_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/806","number":806,"state":"open","locked":false,"title":"Use zonifed cors configuration if configured.","user":{"login":"Bitty9","id":13842256,"node_id":"MDQ6VXNlcjEzODQyMjU2","avatar_url":"https://avatars1.githubusercontent.com/u/13842256?v=4","gravatar_id":"","url":"https://api.github.com/users/Bitty9","html_url":"https://github.com/Bitty9","followers_url":"https://api.github.com/users/Bitty9/followers","following_url":"https://api.github.com/users/Bitty9/following{/other_user}","gists_url":"https://api.github.com/users/Bitty9/gists{/gist_id}","starred_url":"https://api.github.com/users/Bitty9/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bitty9/subscriptions","organizations_url":"https://api.github.com/users/Bitty9/orgs","repos_url":"https://api.github.com/users/Bitty9/repos","events_url":"https://api.github.com/users/Bitty9/events{/privacy}","received_events_url":"https://api.github.com/users/Bitty9/received_events","type":"User","site_admin":false},"body":"Currently, the identity zone configuration offers the ability to set a cors policy per zone. However, that cors policy is never used. Instead, the global cors policy is always used. This pull request uses the cors policy in the identity zone configuration if it differs from the global one. Additionally, since zonified cors policy is based on user input, we set a timeout for a long running regex match as well as a max timeout for matching with all patterns. In order to implement zonified cors policy, it was necessary to switch the filter order slightly so that the cors filter could access the correct policy for a given zone. ","created_at":"2018-04-21T00:48:39Z","updated_at":"2018-06-23T22:44:17Z","closed_at":null,"merged_at":null,"merge_commit_sha":"c0afec88b04b9b6b26f94920ed44dcebbc732394","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":240264515,"node_id":"MDU6TGFiZWwyNDAyNjQ1MTU=","url":"https://api.github.com/repos/cloudfoundry/uaa/labels/unscheduled","name":"unscheduled","color":"D9D9D9","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/806/commits","review_comments_url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/806/comments","review_comment_url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/comments{/number}","comments_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/806/comments","statuses_url":"https://api.github.com/repos/cloudfoundry/uaa/statuses/5264e52efd526fb696940b37657a8d82c4d8febe","head":{"label":"GESoftware-CF:fix/zonifyCorsPolicy","ref":"fix/zonifyCorsPolicy","sha":"5264e52efd526fb696940b37657a8d82c4d8febe","user":{"login":"GESoftware-CF","id":12106002,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEyMTA2MDAy","avatar_url":"https://avatars3.githubusercontent.com/u/12106002?v=4","gravatar_id":"","url":"https://api.github.com/users/GESoftware-CF","html_url":"https://github.com/GESoftware-CF","followers_url":"https://api.github.com/users/GESoftware-CF/followers","following_url":"https://api.github.com/users/GESoftware-CF/following{/other_user}","gists_url":"https://api.github.com/users/GESoftware-CF/gists{/gist_id}","starred_url":"https://api.github.com/users/GESoftware-CF/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GESoftware-CF/subscriptions","organizations_url":"https://api.github.com/users/GESoftware-CF/orgs","repos_url":"https://api.github.com/users/GESoftware-CF/repos","events_url":"https://api.github.com/users/GESoftware-CF/events{/privacy}","received_events_url":"https://api.github.com/users/GESoftware-CF/received_events","type":"Organization","site_admin":false},"repo":{"id":35747522,"node_id":"MDEwOlJlcG9zaXRvcnkzNTc0NzUyMg==","name":"uaa","full_name":"GESoftware-CF/uaa","owner":{"login":"GESoftware-CF","id":12106002,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEyMTA2MDAy","avatar_url":"https://avatars3.githubusercontent.com/u/12106002?v=4","gravatar_id":"","url":"https://api.github.com/users/GESoftware-CF","html_url":"https://github.com/GESoftware-CF","followers_url":"https://api.github.com/users/GESoftware-CF/followers","following_url":"https://api.github.com/users/GESoftware-CF/following{/other_user}","gists_url":"https://api.github.com/users/GESoftware-CF/gists{/gist_id}","starred_url":"https://api.github.com/users/GESoftware-CF/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GESoftware-CF/subscriptions","organizations_url":"https://api.github.com/users/GESoftware-CF/orgs","repos_url":"https://api.github.com/users/GESoftware-CF/repos","events_url":"https://api.github.com/users/GESoftware-CF/events{/privacy}","received_events_url":"https://api.github.com/users/GESoftware-CF/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/GESoftware-CF/uaa","description":"CloudFoundry User Account and Authentication (UAA) Server","fork":true,"url":"https://api.github.com/repos/GESoftware-CF/uaa","forks_url":"https://api.github.com/repos/GESoftware-CF/uaa/forks","keys_url":"https://api.github.com/repos/GESoftware-CF/uaa/keys{/key_id}","collaborators_url":"https://api.github.com/repos/GESoftware-CF/uaa/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/GESoftware-CF/uaa/teams","hooks_url":"https://api.github.com/repos/GESoftware-CF/uaa/hooks","issue_events_url":"https://api.github.com/repos/GESoftware-CF/uaa/issues/events{/number}","events_url":"https://api.github.com/repos/GESoftware-CF/uaa/events","assignees_url":"https://api.github.com/repos/GESoftware-CF/uaa/assignees{/user}","branches_url":"https://api.github.com/repos/GESoftware-CF/uaa/branches{/branch}","tags_url":"https://api.github.com/repos/GESoftware-CF/uaa/tags","blobs_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/refs{/sha}","trees_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/trees{/sha}","statuses_url":"https://api.github.com/repos/GESoftware-CF/uaa/statuses/{sha}","languages_url":"https://api.github.com/repos/GESoftware-CF/uaa/languages","stargazers_url":"https://api.github.com/repos/GESoftware-CF/uaa/stargazers","contributors_url":"https://api.github.com/repos/GESoftware-CF/uaa/contributors","subscribers_url":"https://api.github.com/repos/GESoftware-CF/uaa/subscribers","subscription_url":"https://api.github.com/repos/GESoftware-CF/uaa/subscription","commits_url":"https://api.github.com/repos/GESoftware-CF/uaa/commits{/sha}","git_commits_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/commits{/sha}","comments_url":"https://api.github.com/repos/GESoftware-CF/uaa/comments{/number}","issue_comment_url":"https://api.github.com/repos/GESoftware-CF/uaa/issues/comments{/number}","contents_url":"https://api.github.com/repos/GESoftware-CF/uaa/contents/{+path}","compare_url":"https://api.github.com/repos/GESoftware-CF/uaa/compare/{base}...{head}","merges_url":"https://api.github.com/repos/GESoftware-CF/uaa/merges","archive_url":"https://api.github.com/repos/GESoftware-CF/uaa/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/GESoftware-CF/uaa/downloads","issues_url":"https://api.github.com/repos/GESoftware-CF/uaa/issues{/number}","pulls_url":"https://api.github.com/repos/GESoftware-CF/uaa/pulls{/number}","milestones_url":"https://api.github.com/repos/GESoftware-CF/uaa/milestones{/number}","notifications_url":"https://api.github.com/repos/GESoftware-CF/uaa/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/GESoftware-CF/uaa/labels{/name}","releases_url":"https://api.github.com/repos/GESoftware-CF/uaa/releases{/id}","deployments_url":"https://api.github.com/repos/GESoftware-CF/uaa/deployments","created_at":"2015-05-17T01:44:16Z","updated_at":"2018-06-22T16:59:50Z","pushed_at":"2018-06-22T17:10:19Z","git_url":"git://github.com/GESoftware-CF/uaa.git","ssh_url":"git@github.com:GESoftware-CF/uaa.git","clone_url":"https://github.com/GESoftware-CF/uaa.git","svn_url":"https://github.com/GESoftware-CF/uaa","homepage":"","size":44299,"stargazers_count":20,"watchers_count":20,"language":"Java","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":19,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":19,"open_issues":0,"watchers":20,"default_branch":"master"}},"base":{"label":"cloudfoundry:develop","ref":"develop","sha":"85e0736f1ff9e7a1f8425af1ba2802fddd6c7797","user":{"login":"cloudfoundry","id":621746,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMTc0Ng==","avatar_url":"https://avatars0.githubusercontent.com/u/621746?v=4","gravatar_id":"","url":"https://api.github.com/users/cloudfoundry","html_url":"https://github.com/cloudfoundry","followers_url":"https://api.github.com/users/cloudfoundry/followers","following_url":"https://api.github.com/users/cloudfoundry/following{/other_user}","gists_url":"https://api.github.com/users/cloudfoundry/gists{/gist_id}","starred_url":"https://api.github.com/users/cloudfoundry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloudfoundry/subscriptions","organizations_url":"https://api.github.com/users/cloudfoundry/orgs","repos_url":"https://api.github.com/users/cloudfoundry/repos","events_url":"https://api.github.com/users/cloudfoundry/events{/privacy}","received_events_url":"https://api.github.com/users/cloudfoundry/received_events","type":"Organization","site_admin":false},"repo":{"id":3382195,"node_id":"MDEwOlJlcG9zaXRvcnkzMzgyMTk1","name":"uaa","full_name":"cloudfoundry/uaa","owner":{"login":"cloudfoundry","id":621746,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMTc0Ng==","avatar_url":"https://avatars0.githubusercontent.com/u/621746?v=4","gravatar_id":"","url":"https://api.github.com/users/cloudfoundry","html_url":"https://github.com/cloudfoundry","followers_url":"https://api.github.com/users/cloudfoundry/followers","following_url":"https://api.github.com/users/cloudfoundry/following{/other_user}","gists_url":"https://api.github.com/users/cloudfoundry/gists{/gist_id}","starred_url":"https://api.github.com/users/cloudfoundry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloudfoundry/subscriptions","organizations_url":"https://api.github.com/users/cloudfoundry/orgs","repos_url":"https://api.github.com/users/cloudfoundry/repos","events_url":"https://api.github.com/users/cloudfoundry/events{/privacy}","received_events_url":"https://api.github.com/users/cloudfoundry/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/cloudfoundry/uaa","description":"CloudFoundry User Account and Authentication (UAA) Server","fork":false,"url":"https://api.github.com/repos/cloudfoundry/uaa","forks_url":"https://api.github.com/repos/cloudfoundry/uaa/forks","keys_url":"https://api.github.com/repos/cloudfoundry/uaa/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cloudfoundry/uaa/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cloudfoundry/uaa/teams","hooks_url":"https://api.github.com/repos/cloudfoundry/uaa/hooks","issue_events_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/events{/number}","events_url":"https://api.github.com/repos/cloudfoundry/uaa/events","assignees_url":"https://api.github.com/repos/cloudfoundry/uaa/assignees{/user}","branches_url":"https://api.github.com/repos/cloudfoundry/uaa/branches{/branch}","tags_url":"https://api.github.com/repos/cloudfoundry/uaa/tags","blobs_url":"https://api.github.com/repos/cloudfoundry/uaa/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cloudfoundry/uaa/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cloudfoundry/uaa/git/refs{/sha}","trees_url":"https://api.github.com/repos/cloudfoundry/uaa/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cloudfoundry/uaa/statuses/{sha}","languages_url":"https://api.github.com/repos/cloudfoundry/uaa/languages","stargazers_url":"https://api.github.com/repos/cloudfoundry/uaa/stargazers","contributors_url":"https://api.github.com/repos/cloudfoundry/uaa/contributors","subscribers_url":"https://api.github.com/repos/cloudfoundry/uaa/subscribers","subscription_url":"https://api.github.com/repos/cloudfoundry/uaa/subscription","commits_url":"https://api.github.com/repos/cloudfoundry/uaa/commits{/sha}","git_commits_url":"https://api.github.com/repos/cloudfoundry/uaa/git/commits{/sha}","comments_url":"https://api.github.com/repos/cloudfoundry/uaa/comments{/number}","issue_comment_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/comments{/number}","contents_url":"https://api.github.com/repos/cloudfoundry/uaa/contents/{+path}","compare_url":"https://api.github.com/repos/cloudfoundry/uaa/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cloudfoundry/uaa/merges","archive_url":"https://api.github.com/repos/cloudfoundry/uaa/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cloudfoundry/uaa/downloads","issues_url":"https://api.github.com/repos/cloudfoundry/uaa/issues{/number}","pulls_url":"https://api.github.com/repos/cloudfoundry/uaa/pulls{/number}","milestones_url":"https://api.github.com/repos/cloudfoundry/uaa/milestones{/number}","notifications_url":"https://api.github.com/repos/cloudfoundry/uaa/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cloudfoundry/uaa/labels{/name}","releases_url":"https://api.github.com/repos/cloudfoundry/uaa/releases{/id}","deployments_url":"https://api.github.com/repos/cloudfoundry/uaa/deployments","created_at":"2012-02-07T22:40:55Z","updated_at":"2018-06-23T22:12:07Z","pushed_at":"2018-06-22T22:24:14Z","git_url":"git://github.com/cloudfoundry/uaa.git","ssh_url":"git@github.com:cloudfoundry/uaa.git","clone_url":"https://github.com/cloudfoundry/uaa.git","svn_url":"https://github.com/cloudfoundry/uaa","homepage":"","size":47638,"stargazers_count":768,"watchers_count":768,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":579,"mirror_url":null,"archived":false,"open_issues_count":65,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":579,"open_issues":65,"watchers":768,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/806"},"html":{"href":"https://github.com/cloudfoundry/uaa/pull/806"},"issue":{"href":"https://api.github.com/repos/cloudfoundry/uaa/issues/806"},"comments":{"href":"https://api.github.com/repos/cloudfoundry/uaa/issues/806/comments"},"review_comments":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/806/comments"},"review_comment":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/806/commits"},"statuses":{"href":"https://api.github.com/repos/cloudfoundry/uaa/statuses/5264e52efd526fb696940b37657a8d82c4d8febe"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"DennisDenuto"}}