apache wicket load resource - error 403 (Forbidden)

Question

I am trying to load some resource files( css and javascript) in apache wicket and for resources loaded with forReference I got this error:

Failed to load resource: the server responded with a status of 403 (Forbidden)

The others loaded with forUrl everything is okay. The code from my base web page is:

abstract public class BasePage extends WebPage  implements IHeaderContributor {
  private static final long serialVersionUID = 1L;

  public BasePage() {
    // some code
  }

  @Override
  public void renderHead(IHeaderResponse response) {

    response.render(JavaScriptHeaderItem.forUrl("//ajax.googleapis.com/ajax/libs/jquery/2.1.0/jquery.min.js"));
    response.render(JavaScriptHeaderItem.forUrl("//netdna.bootstrapcdn.com/bootstrap/3.1.0/js/bootstrap.min.js"));
    response.render(CssReferenceHeaderItem.forUrl("//netdna.bootstrapcdn.com/bootstrap/3.1.0/css/bootstrap.min.css"));
    CssResourceReference STYLE_CSS = new CssResourceReference(BasePage.class, "style.css");
    response.render(CssReferenceHeaderItem.forReference(STYLE_CSS));
  }
}

I tried with wicket-bootstrap from wicket-experimental and I got the same results. Is something that I am missing on project setup?

Answer 1

I had the same problem with resource loading.

This problem occured when I configured AnnotationsRoleAuthorizationStrategy in my init() method. When I comment out the line where I set this Authorization Strategy, everything works.

I find out that this problem is only in Wicket 7.0-Snapshot version of Wicket, so every wicket dependency with Snapshot version(wicket-core-7.0-Snapshot, wicket-auth-roles-7.0-Snapshot, wicket-spring-7.0-Snapshot-7.0-Snapshot) I replaced with the M5 version of Wicket v7, so with wicket-core-7.0-M5, wicket-auth-roles-7.0-M5, wicket-spring-7.0-M5

Now, everything works with M5 version. So, probably there is a bug with this AuthorizationStrategy in Snapshot version

Answer 2

This is a new feature in wicket 7 for restrict resources from the IAuthorizationStrategy, the method IAuthorizationStrategy#isResourceAuthorized(IResource, PageParameters) does this. If this method always returns false than you get the behavior as described above.

I changed this in my application to return true to have the same behavior as in wicket version 6.