[logback-dev] [JIRA] Updates for LOGBACK-1580: logback-access uses response.getStatus improperly

[QOS.CH (JIRA)]

logback / LOGBACK-1580 [Open]
logback-access uses response.getStatus improperly

==============================

Here's what changed in this issue in the last few minutes.
This issue has been created
This issue is now assigned to you.

View or comment on issue using this link
https://jira.qos.ch/browse/LOGBACK-1580

==============================
 Issue created
------------------------------

Joakim Erdfelt created this issue on 09/Oct/21 3:34 PM
Summary:              logback-access uses response.getStatus improperly
Issue Type:           Bug
Assignee:             Logback dev list
Components:           logback-access
Created:              09/Oct/21 3:34 PM
Priority:             Major
Reporter:             Joakim Erdfelt
Description:
  The use of HttpServletResponse.getStatus is not reliable for a request logging library.
  
  The status code is not immutable on the servlet spec and is often reset or change from when the status code was committed (sent over the network) vs when it reaches the request logging implementation in `logback-access`.
  
  Libraries like spring-framework, spring-mvc, spring-boot, spring-security, all change the status code on the way out of the context dispatch.
  
  Every decent servlet container tracks the "committed state" of the Request and Response objects and use those values for their own request logging implementation just to ensure that their request logging contains accurate (as seen on the network) information in the request log.
  
  Example:
  
  Jetty has `response.getCommittedMetaData().getStatus()` for the status code.


==============================
 This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)