Rudder

A simple reload of the page make things work again.

the error about unsafePerformSync is on every page
see https://www.rudder-project.org/redmine/issues/11991

Error now is

Content Security Policy: La directive « frame-src » est obsolète. Veuillez utiliser la directive « child-src » à la place.
Échec du chargement pour l’élément <script> dont la source est « https://192.168.44.2/rudder/lift/page/F256739716637QEWLDN.js ».
index.html:627
Erreur dans les liens source : request failed with status 404
URL de la ressource : https://192.168.44.2/rudder/cache-4.3.0~alpha1-SNAPSHOT/javascript/angular/angular.min.js
URL du lien source : angular.min.js.map

Last error has no impact, it's only when you open a js console, and it does not find .map file for angular.min.js file (a map files allow to deminify a file on demand)

Erreur dans les liens source : request failed with status 404
URL de la ressource : https://192.168.44.2/rudder/cache-4.3.0~alpha1-SNAPSHOT/javascript/angular/angular.min.js
URL du lien source : angular.min.js.map

I need to looke depper in the first line about the frame-src/child-src

This is still happening

Apache logs at login are

192.168.42.1 - - [20/Mar/2018:12:59:37 -0500] "POST /rudder/j_spring_security_check HTTP/1.1" 302 - "https://192.168.42.2/rudder/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0" 
192.168.42.1 - - [20/Mar/2018:12:59:38 -0500] "GET /rudder/secure/index.html HTTP/1.1" 200 6901 "https://192.168.42.2/rudder/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0" 
192.168.42.1 - - [20/Mar/2018:12:59:38 -0500] "GET /rudder/lift/page/F229878065677F1DCXM.js HTTP/1.1" 404 17711 "https://192.168.42.2/rudder/secure/index.html" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0" 
192.168.42.1 - - [20/Mar/2018:12:58:40 -0500] "GET /rudder/lift/comet/54829882895/F229878025479Z03TWD/F229878025492TXRMZI?F2298780254933GF1EH=229878025496&F229878025497IP2KCX=229878033300&_=1521541447761 HTTP/1.1" 502 1277 "https://192.168.42.2/rudder/secure/utilities/techniqueEditor" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.109 Safari/537.36" 
192.168.42.1 - - [20/Mar/2018:12:59:41 -0500] "GET /rudder/lift/page/F229878065677F1DCXM.js HTTP/1.1" 404 17711 "https://192.168.42.2/rudder/secure/index.html" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0" 

Trying with LiftRules.enableLiftGC = false in class Boot, it didn't change anything
It works with Jetty 6 & 7, but not 9

Adding in HomePage.scala

LiftRules.enableLiftGC = false
LiftRules.autoIncludeComet = _ => false

the failing JS contains the Lift configuration part:

var lift_settings = {};
window.lift.extend(lift_settings,window.liftJQuery);
window.lift.extend(lift_settings,{"liftPath": "/rudder-web/lift", "ajaxRetryCount": 1, "ajaxPostTimeout": 30000, "gcPollingInterval": 75000, "gcFailureRetryTimeout": 15000, "cometGetTimeout": 140000, "cometFailureRetryTimeout": 10000, "cometServer": null, "logError": function(msg) {lift.defaultLogError(msg);}, "ajaxOnFailure": function() {alert("The server cannot be contacted at this time");}, "ajaxOnStart": function() {jQuery('#'+"ajax-loader").show();}, "ajaxOnEnd": function() {jQuery('#'+"ajax-loader").hide();}});
window.lift.init(lift_settings);
var destroy_F896022439538OB51J3 = function() {}
var destroy_F896022439541S1NB1T = function() {}
jQuery(document).ready(function() {lift.registerComets({"F896022439538OB51J3": 896022439539, "F896022439541S1NB1T": 896022439542},true);});

The problem is with the existing sessions created by jetty in login page. If I delete the session cookie before hiting submit, then the JS is correctly loaded.

There is a thread on Liftweb google talking about that here: https://groups.google.com/forum/#!topic/liftweb/lcn6U6_Igxk

This is a Liftweb bug, reported here: https://github.com/lift/framework/issues/1947. Waiting for a workaround :(

Between, we can workaround the problem by forcing spring security to not use "HttpServletRequest.changeSessionId". We would be able to migrate back towards the more efficient solution when when want.