logback / LOGBACK-1580 [Open] logback-access uses response.getStatus improperly ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1580 ============================== Issue created ------------------------------ Joakim Erdfelt created this issue on 09/Oct/21 3:34 PM Summary: logback-access uses response.getStatus improperly Issue Type: Bug Assignee: Logback dev list Components: logback-access Created: 09/Oct/21 3:34 PM Priority: Major Reporter: Joakim Erdfelt Description: The use of HttpServletResponse.getStatus is not reliable for a request logging library. The status code is not immutable on the servlet spec and is often reset or change from when the status code was committed (sent over the network) vs when it reaches the request logging implementation in `logback-access`. Libraries like spring-framework, spring-mvc, spring-boot, spring-security, all change the status code on the way out of the context dispatch. Every decent servlet container tracks the "committed state" of the Request and Response objects and use those values for their own request logging implementation just to ensure that their request logging contains accurate (as seen on the network) information in the request log. Example: Jetty has `response.getCommittedMetaData().getStatus()` for the status code. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)