{"action":"created","issue":{"url":"https://api.github.com/repos/dropwizard/dropwizard/issues/1311","labels_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/1311/labels{/name}","comments_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/1311/comments","events_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/1311/events","html_url":"https://github.com/dropwizard/dropwizard/issues/1311","id":113923490,"number":1311,"title":"ChainedAuthFilter throws NPE on no credentials","user":{"login":"ferdy-lw","id":1803091,"avatar_url":"https://avatars.githubusercontent.com/u/1803091?v=3","gravatar_id":"","url":"https://api.github.com/users/ferdy-lw","html_url":"https://github.com/ferdy-lw","followers_url":"https://api.github.com/users/ferdy-lw/followers","following_url":"https://api.github.com/users/ferdy-lw/following{/other_user}","gists_url":"https://api.github.com/users/ferdy-lw/gists{/gist_id}","starred_url":"https://api.github.com/users/ferdy-lw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ferdy-lw/subscriptions","organizations_url":"https://api.github.com/users/ferdy-lw/orgs","repos_url":"https://api.github.com/users/ferdy-lw/repos","events_url":"https://api.github.com/users/ferdy-lw/events{/privacy}","received_events_url":"https://api.github.com/users/ferdy-lw/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-10-28T21:15:44Z","updated_at":"2015-10-29T11:16:12Z","closed_at":null,"body":"The chained auth filter will throw a NullPointerException if none of the filters create a securityContext or throw a WebApplicationException. In this case the `firstException` will be null and the throw fails:\r\n\r\nhttps://github.com/dropwizard/dropwizard/blob/master/dropwizard-auth/src/main/java/io/dropwizard/auth/chained/ChainedAuthFilter.java#L55\r\n\r\nIs this expected behaviour? If we use auth filters must we set the securityContext or throw a WebApplicationException? Is this the same requirement for a single filter? How is this to work with `@Auth(required=false)`? There does not appear to be a test case for this scenario?\r\n\r\nThe old `chainedAuthFactory` did check for null:\r\nhttps://github.com/dropwizard/dropwizard/blob/v0.8.4/dropwizard-auth/src/main/java/io/dropwizard/auth/ChainedAuthFactory.java#L104"},"comment":{"url":"https://api.github.com/repos/dropwizard/dropwizard/issues/comments/152149580","html_url":"https://github.com/dropwizard/dropwizard/issues/1311#issuecomment-152149580","issue_url":"https://api.github.com/repos/dropwizard/dropwizard/issues/1311","id":152149580,"user":{"login":"joschi","id":43951,"avatar_url":"https://avatars.githubusercontent.com/u/43951?v=3","gravatar_id":"","url":"https://api.github.com/users/joschi","html_url":"https://github.com/joschi","followers_url":"https://api.github.com/users/joschi/followers","following_url":"https://api.github.com/users/joschi/following{/other_user}","gists_url":"https://api.github.com/users/joschi/gists{/gist_id}","starred_url":"https://api.github.com/users/joschi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joschi/subscriptions","organizations_url":"https://api.github.com/users/joschi/orgs","repos_url":"https://api.github.com/users/joschi/repos","events_url":"https://api.github.com/users/joschi/events{/privacy}","received_events_url":"https://api.github.com/users/joschi/received_events","type":"User","site_admin":false},"created_at":"2015-10-29T11:16:12Z","updated_at":"2015-10-29T11:16:12Z","body":"@ferdy-lw Could you please provide a small, minimal Dropwizard application to reproduce this issue?"}}