Getting UT005023, UT010019 Response already commited on secure pages with Wildfly, Struts2 and convention plugin
<p>This is my first project with Struts2. I'm using the convention plugin and running the whole thing on Wildfly. I've created a few actions, like a user-registration.action, and they work fine. However, once I added security, I started getting the error in the title of this. It happens when I try to log in. The login page never appears and instead I get the error.</p>

<p>Here's the relevant part of my web.xml</p>

<pre><code>&lt;welcome-file-list&gt;
  &lt;welcome-file&gt;/index.action&lt;/welcome-file&gt;
&lt;/welcome-file-list&gt;

&lt;security-constraint&gt;
  &lt;web-resource-collection&gt;
    &lt;web-resource-name&gt;SecurePages&lt;/web-resource-name&gt;
    &lt;description&gt;All secure pages&lt;/description&gt;
    &lt;url-pattern&gt;/secure/*&lt;/url-pattern&gt;
    &lt;http-method&gt;POST&lt;/http-method&gt;
    &lt;http-method&gt;GET&lt;/http-method&gt;
  &lt;/web-resource-collection&gt;
  &lt;auth-constraint&gt;
    &lt;role-name&gt;Security Admin&lt;/role-name&gt;
  &lt;/auth-constraint&gt;
  &lt;user-data-constraint&gt;
    &lt;description&gt;SSL not required&lt;/description&gt;
    &lt;transport-guarantee&gt;NONE&lt;/transport-guarantee&gt;
  &lt;/user-data-constraint&gt;
&lt;/security-constraint&gt;
&lt;security-constraint&gt;
  &lt;display-name&gt;No direct JSP access&lt;/display-name&gt;
  &lt;web-resource-collection&gt;
      &lt;web-resource-name&gt;No-JSP&lt;/web-resource-name&gt;
      &lt;url-pattern&gt;*.jsp&lt;/url-pattern&gt;
  &lt;/web-resource-collection&gt;
  &lt;auth-constraint&gt;
      &lt;role-name&gt;no-users&lt;/role-name&gt;
  &lt;/auth-constraint&gt;
&lt;/security-constraint&gt;

&lt;login-config&gt;
  &lt;auth-method&gt;FORM&lt;/auth-method&gt;
  &lt;form-login-config&gt;
    &lt;form-login-page&gt;/login.action&lt;/form-login-page&gt;
    &lt;form-error-page&gt;/login-failed.action&lt;/form-error-page&gt;
  &lt;/form-login-config&gt;
&lt;/login-config&gt;
</code></pre>

<p>Here's the Struts2 action to display the home page. It works. It's mapped to /context/index.action, which is in my welcome file list in the web.xml</p>

<pre><code>@Result(name = "success", type = "tiles", location = "index")
public class IndexAction extends ActionSupport
{
  public String execute() throws Exception
  {
    return SUCCESS;
  }
}
</code></pre>

<p>Here's the code for displaying the login page. If I access it directly, like /context/login.action, it successfully displays the login page. However, it does not get displayed if I'm actually trying to log in.</p>

<pre><code>@Result(name = "success", type = "tiles", location = "login")
public class LoginAction extends ActionSupport
{
  public String execute()
  {
    return SUCCESS;
  }
}
</code></pre>

<p>Here's the Struts2 action to be executed after login. This is mapped to /context/secure/secure-index.action. This is the href of the "Login" menu item on the home page's menu bar.</p>

<pre><code>@Result(name = "success", type = "tiles", location = "secure_index")
public class SecureIndexAction extends ActionSupport
{
  public String execute() throws Exception
  {
    return SUCCESS;
  }
}
</code></pre>

<p>Here's the stack trace:</p>

<pre><code>ERROR [io.undertow.request] (default task-5) UT005023: Exception handling request to /campaigner-security/login.action: java.lang.IllegalStateException: UT010019: Response already commited
at io.undertow.servlet.spec.HttpServletResponseImpl.sendError(HttpServletResponseImpl.java:124) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.spec.HttpServletResponseImpl.sendError(HttpServletResponseImpl.java:167) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:61) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.handlers.DisableCacheHandler.handleRequest(DisableCacheHandler.java:33) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:51) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:63) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:56) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:261) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:247) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:76) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:166) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:197) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:759) [undertow-core-1.1.0.Final.jar:1.1.0.Final]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_71]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_71]
at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_71]
</code></pre>

<p>If used directly, the login.action and login-failed.action work fine.</p>

<p>What do I need to do to fix this?</p>