WebSockets Next: Security cleanup

[mkouba]

• do not force authentication in a dedicted handler so that it's possible to capture the SecurityIdentity before the HTTP upgrade but use the deferred identity instead
• also change the HttpUpgradeContext to consume Uni instead of SecurityIdentity

[mkouba]

This is a breaking change in the HttpUpgradeContext and should be documented in the migration guide. Although the HttpUpgradeContext is not even mentioned in the docs.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 8d678da.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

[michalvavrik]

This is a breaking change in the HttpUpgradeContext and should be documented in the migration guide. Although the HttpUpgradeContext is not even mentioned in the docs.

No, but this context is used there without identity - https://quarkus.io/version/main/guides/websockets-next-reference#inspect-andor-reject-http-upgrade. I think it is breaking change that has very low impact since the HTTP checks are reactive so it is easy change

[mkouba]

This is a breaking change in the HttpUpgradeContext and should be documented in the migration guide. Although the HttpUpgradeContext is not even mentioned in the docs.

No, but this context is used there without identity - https://quarkus.io/version/main/guides/websockets-next-reference#inspect-andor-reject-http-upgrade. I think it is breaking change that has very low impact since the HTTP checks are reactive so it is easy change

Agreed. Also the WS Next API is still "experimental" :D

[michalvavrik]

This is right change as in the past we proactively authenticated even though proactive auth was disabled. WS Next behavior will be similar to what other stacks do.

[sberyozkin]

LGTM, thanks @mkouba, and @michalvavrik for answering the question I was about to ask Martin :-), what impact this change would have...

[gsmet]

@mkouba is it something you want for 3.16? If so, we need to add the backport label as it missed the CR1 train.