How to remove URL form thread name?

classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

How to remove URL form thread name?

Paul Sprague
Hello,

Restlet appears to be changing the thread name to include a URL. While useful in general we cannot do this for security reasons since some URLs will contain sensitive data in the form of URL template parameters in the path section.

Does anyone know how to disable this feature?

Thanks
Paul

------------------------------------------------------
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=3080063
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: How to remove URL form thread name?

Tim Peierls
I can find only two instances of ThreadFactory in the Restlet codebase, neither of which add a URL. The one in TaskService just replaces "pool" with "restlet" in whatever name the default factory uses. The LoggingThreadFactory uses the name "Restlet-XXX" where XXX is the hashcode of the thread being returned.

That's not to say that Restlet isn't doing this, just that it probably isn't happening for threads created via ThreadFactory.

Can you pinpoint what kind of threads are named with URLs?


On Fri, Jun 6, 2014 at 2:48 PM, Paul Sprague <[hidden email]> wrote:
Hello,

Restlet appears to be changing the thread name to include a URL. While useful in general we cannot do this for security reasons since some URLs will contain sensitive data in the form of URL template parameters in the path section.

Does anyone know how to disable this feature?

Thanks
Paul

------------------------------------------------------
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=3080063

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Re: How to remove URL form thread name?

Paul Sprague
Hi Tim,

I'm using Restlet 2.2 with the jetty server connector. It would make sense I guess that this is probably a jetty feature.

An example of what I'm seeing:
20140606-19:53:09.000+0000|qtp1327174230-143193 - /v1/accounts/<deleted>|<rest of log message>

Thanks,
Paul

> I can find only two instances of ThreadFactory in the Restlet codebase,
> neither of which add a URL. The one in TaskService just replaces "pool"
> with "restlet" in whatever name the default factory uses. The
> LoggingThreadFactory uses the name "Restlet-XXX" where XXX is the hashcode
> of the thread being returned.
>
> That's not to say that Restlet isn't doing this, just that it probably
> isn't happening for threads created via ThreadFactory.
>
> Can you pinpoint what kind of threads are named with URLs?
>
>
> On Fri, Jun 6, 2014 at 2:48 PM, Paul Sprague <psprague at paypal dot com> wrote:
>
> > Hello,
> >
> > Restlet appears to be changing the thread name to include a URL. While
> > useful in general we cannot do this for security reasons since some URLs
> > will contain sensitive data in the form of URL template parameters in the
> > path section.
> >
> > Does anyone know how to disable this feature?
> >
> > Thanks
> > Paul
> >
> > ------------------------------------------------------
> >
> > http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=3080063
> >

------------------------------------------------------
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=3080070
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Re: How to remove URL form thread name?

Jerome Louvel-3
Hi Paul,

I suspect this is a Jetty feature as well. If you use Jetty as a Restlet Server connector, you can have access to the underlying Jetty Server object (and then its thread pool) via this class:
http://restlet.com/learn/javadocs/snapshot/jse/ext/org/restlet/ext/jetty/JettyServerHelper.html

If you are using Jetty as a Servlet container, then you need to directly look at its configuration options.

Best regards,
Jerome

------------------------------------------------------
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=3080077
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Re: How to remove URL form thread name?

Paul Sprague
Found it. Yes this is a Jetty feature and it is only enabled when debug logging is on.

https://github.com/eclipse/jetty.project/blob/jetty-8.1.5.v20120716/jetty-server/src/main/java/org/eclipse/jetty/server/AbstractHttpConnection.java#L417

> Hi Paul,
>
> I suspect this is a Jetty feature as well. If you use Jetty as a Restlet Server connector, you can have access to the underlying Jetty Server object (and then its thread pool) via this class:
> http://restlet.com/learn/javadocs/snapshot/jse/ext/org/restlet/ext/jetty/JettyServerHelper.html
>
> If you are using Jetty as a Servlet container, then you need to directly look at its configuration options.
>
> Best regards,
> Jerome

------------------------------------------------------
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=3080080
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

RE: Re: How to remove URL form thread name?

Jerome Louvel-3
Thanks Paul for the update, great to know that you solved it!

Best regards,
Jerome


> Found it. Yes this is a Jetty feature and it is only enabled when debug logging is on.
>
> https://github.com/eclipse/jetty.project/blob/jetty-8.1.5.v20120716/jetty-server/src/main/java/org/eclipse/jetty/server/AbstractHttpConnection.java#L417

------------------------------------------------------
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=3083289
Loading...