ClassCastException Thrown When Getting X509Certificate in Jetty-7.1.6.v20100715

Question

The filter I wrote threw ClassCastException

[Ljava.security.cert.X509Certificate; cannot be cast to java.security.cert.X509Certificate

when I tried to cast an Object extracted from the ServletRequest attribute, i.e.

public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain) throws
IOException, ServletException
        {
            X509Certificate cert = (X509Certificate) req.getAttribute("javax.servlet.request.X509Certificate");
            System.out.println("cert dn " + cert.getSubjectDN().toString());
            filterChain.doFilter(req, res);
        }

As I dug deeper I understood that exception like this was most probably caused by different classloaders though they are of same class type. How do I resolve this?

Thanks

I used the following Spring 3 configurarion to load Jetty 7 piecemeal

 <bean class="org.eclipse.jetty.server.Server"
      init-method="start" destroy-method="stop">

    <property name="connectors">
        <list>
            <bean id="SSLConnector" class="org.eclipse.jetty.server.ssl.SslSocketConnector">
                <property name="port" value="8553"/>
                <property name="maxIdleTime" value="3600000"/>
                <property name="soLingerTime" value="-1"/>
                <property name="needClientAuth" value="true"/>
                <property name="sslContext">
                    <ref bean="sslContext"/>
                </property>
            </bean>
        </list>
    </property>

    <property name="handler">
        <bean name="contexts" class="org.eclipse.jetty.server.handler.ContextHandlerCollection">
            <property name="handlers">
                <list>
                    <bean class="org.eclipse.jetty.servlet.ServletContextHandler">
                        <property name="contextPath">
                            <value>/caas</value>
                        </property>

                        <property name="resourceBase" value="src/main/secure_webapp"/>

                        <property name="sessionHandler">
                            <bean class="org.eclipse.jetty.server.session.SessionHandler"/>
                        </property>

                        <property name="servletHandler">

                            <bean class="org.eclipse.jetty.servlet.ServletHandler">
                              <property name="filters">
                                    <list>
                                        <bean class="org.eclipse.jetty.servlet.FilterHolder">
                                            <property name="name" value="myfilter"/>
                                            <property name="filter">
                                                <bean class="com.acme.MyFilter"/>
                                            </property>
                                        </bean>
                                    </list>
                                </property>

                                <property name="filterMappings">
                                    <list>
                                        <bean class="org.eclipse.jetty.servlet.FilterMapping">
                                            <property name="pathSpec">
                                                <value>/*</value>
                                            </property>
                                            <property name="filterName"
                                                      value="myfilter"/>
                                        </bean>
                                    </list>
                                </property>

                                <property name="servlets">
                                    <list>
                                        <bean class="org.eclipse.jetty.servlet.ServletHolder">
                                            <property name="name" value="default"/>
                                            <property name="servlet">
                                                <bean class="org.eclipse.jetty.servlet.DefaultServlet"/>
                                            </property>
                                        </bean>
                                    </list>
                                </property>

                                <property name="servletMappings">
                                    <list>
                                        <bean class="org.eclipse.jetty.servlet.ServletMapping">
                                            <property name="pathSpecs">
                                                <list>
                                                    <value>/</value>
                                                </list>
                                            </property>
                                            <property name="servletName" value="default"/>
                                        </bean>
                                    </list>
                                </property>
                            </bean>
                        </property>
                    </bean>
                </list>
            </property>
        </bean>
    </property>
</bean>

Answer 1

I don't think it's a duplicate class problem in this case, because X509Certificate is contained in the core JRE libraries. There is, afaik, no other library which provides this abstract class.

I think the problem is the getAttribute() returns an array of X509Certificate objects, whereas you cast it down to a single object. The beginning [L of the ClassCastException message indicates that the object returned is an array.

Try casting to an array of certificates:

X509Certificate[] cert = (X509Certificate[])
         req.getAttribute("javax.servlet.request.X509Certificate");

Also, i think that you should retrieve the object from getAttribute() and use instanceof checks to see whether it contains the desired types and maybe handle them differently.