[#1803,TCK] Call org.osgi.service.servlet.context.ServletContextHelper#finishSecurity() only when needed

Author: grgrzybek

pax-web-spi/src/main/java/org/ops4j/pax/web/service/spi/servlet/OsgiFilterChain.java

@@ -97,8 +97,9 @@ public void doFilter(ServletRequest request, ServletResponse response) throws IO
 
 		// nothing left - time to call security and if it passes - call the rest of the chain (normal filters
 		// and target servlet)
+		boolean finishRequired = false;
 		try {
-			if (webContext == null || webContext.handleSecurity(req, res)) {
+			if (webContext == null || (finishRequired = webContext.handleSecurity(req, res))) {
 				if (authListener != null && webContext != null) {
 					// it means we've passed the OSGi security handler
 					// here, the listener may translate (if available):
@@ -123,7 +124,7 @@ public void doFilter(ServletRequest request, ServletResponse response) throws IO
 				}
 			}
 		} finally {
-			if (webContext != null) {
+			if (webContext != null && finishRequired) {
 				webContext.finishSecurity(req, res);
 			}
 		}

pax-web-undertow/src/main/java/org/ops4j/pax/web/service/undertow/internal/PaxWebSecurityHandler.java

@@ -59,8 +59,9 @@ public void handleRequest(HttpServerExchange exchange) throws Exception {
 						webContext = defaultWebContainerContext;
 					}
 
+					boolean finishRequired = false;
 					try {
-						if (webContext == null || webContext.handleSecurity(req, res)) {
+						if (webContext == null || (finishRequired = webContext.handleSecurity(req, res))) {
 							if (webContext != null) {
 								final Object user = req.getAttribute(ServletContextHelper.REMOTE_USER);
 								final Object authType = req.getAttribute(ServletContextHelper.AUTHENTICATION_TYPE);
@@ -98,7 +99,7 @@ public void handleRequest(HttpServerExchange exchange) throws Exception {
 							}
 						}
 					} finally {
-						if (webContext != null) {
+						if (webContext != null && finishRequired) {
 							webContext.finishSecurity(req, res);
 						}
 					}