COOP and COEP exemptions compare with the context path, so page exemptions never match
Maintainers usually reply within 1 day
@VelpulaGangavardhan is already working on this.
Since Oct 16, 2026.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 67/100
Research direction
Read CrossOriginOpenerPolicyRequestCycleListener and CrossOriginEmbedderPolicyRequestCycleListener, then inspect testCoopHeadersNotSetExemptedPath and testCoepHeadersNotSetExemptedPath. Enable each policy in the exemption tests and compare exemptions with the request path inside the application; document the expected path form in addExemptedPath. Done means an exempted page omits the header while non-exempted pages still receive it.
Written by the indexing model from the issue text.
Description
CrossOriginOpenerPolicyRequestCycleListener and CrossOriginEmbedderPolicyRequestCycleListener decide whether a request is exempted from the header with
String path = request.getContextPath();
if (coopConfig.getExemptions().contains(path))
getContextPath() is the context path of the web application, the same for every request (often ""), not the path of the requested page. A path added with addExemptedPath("/some/page") therefore never matches, and the header is sent on every page. Only exempting the context path itself has an effect, and then it exempts the whole application.
The tests do not catch this: testCoopHeadersNotSetExemptedPath and testCoepHeadersNotSetExemptedPath run with CoopMode.DISABLED / CoepMode.DISABLED, where no header is sent at all, so they pass whether or not the exemption works.
Proposed fix: compare the exemptions with the request path inside the application (for example the servlet path plus path info, or the Wicket request URL), test an exemption with the policy enabled, and document in addExemptedPath which form of path is expected. Same code on master and wicket-10.x.
- Dominant language
- Java
- Stars
- 797
- Forks
- 416
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 41
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/wicket
-
Quickstart archetype: give slf4j-simple test scopePossibly taken @Vis-halV claimed this 1 day ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 90/100
apache/wicket#1678 · 1 comment ·
Maintainers usually reply within 1 day
-
The CSP report-uri is lost in development mode because strict() clears itPossibly taken @VelpulaGangavardhan claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
apache/wicket#1660 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
apache/wicket#1567 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
[Bug] dubbo.protocol.triple.max-message-size is only read from OS environment variablesPossibly taken @CCCLL claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
youngyangyang04/leetcode-master#3026 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
hierynomus/sshj#1070 ·
-
Typo in ExecutorTemplate.cacelAllFuturesPossibly taken @xgx2025 claimed this today. Open
Difficulty 1/5 1-3 hours Newbie friendliness 82/100