Browsing a public repository as an anonymous user causes excessive ERROR logging from DefaultWebInterfaceManager and WebFragmentSupport due to AuthorisationException in web fragment condition evaluation

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: High
    • None
    • Affects Version/s: 10.2.4
    • None
    • 1
    • Severity 3 - Minor

      Issue Summary

      When an unauthenticated (anonymous) user or a user without repository permissions browses a public repository, multiple web fragment conditions throw AuthorisationException that gets logged as ERROR. Two distinct web fragments are affected:

      1. Merge Queue navigation - RepositoryMergeQueueEnabledCondition attempts to evaluate merge queue settings via DefaultMergeQueueSettingsService.validateReadPermissions(), throwing an AuthorisationException logged by DefaultWebInterfaceManager.
      2. Repository Archived Banner - HasRepositoryArchivePermissionCondition calls DefaultPolicyService.getRepositoryArchivePolicy() via validateForGlobal(), throwing an AuthorisationException logged by WebFragmentSupport.

      Both errors are triggered on every page load for the affected repository (e.g., by search engine crawlers like Googlebot), resulting in excessively large log files impacting disk space and log readability.

      Steps to Reproduce

      1. Enable anonymous access or have a public repository accessible to unauthenticated users.
      2. Access the repository browse page as an anonymous user or via a bot/crawler (e.g., GET /projects/EDELIVERY/repos/eessi-as4.net/browse/... or GET /projects/rproj/repos/publicrepo/browse).
      3. Observe the atlassian-bitbucket.log file.

      Expected Results

      The web fragment conditions (RepositoryMergeQueueEnabledCondition and HasRepositoryArchivePermissionCondition) should gracefully handle the case where the user lacks permissions either by checking permissions before attempting to load settings, or by catching the AuthorisationException internally without propagating it to DefaultWebInterfaceManager/WebFragmentSupport. No ERROR-level logging should occur for this expected scenario.

      Actual Results

      The below exception is thrown in the atlassian-bitbucket.log file:

      Error 1 - Merge Queue condition (DefaultWebInterfaceManager):

      2026-06-22 13:51:39,528 ERROR [http-nio-7990-exec-5] @1TWIGI0x831x148x0 10.230.0.213,172.50.0.2 "GET /projects/rproj/repos/publicrepo/browse HTTP/1.1" c.a.p.w.i.DefaultWebInterfaceManager Could not evaluate condition 'com.atlassian.plugin.web.conditions.AndCompositeCondition@67b12db7' for descriptor: com.atlassian.bitbucket.server.bitbucket-server-web-fragments:bitbucket.repository.nav.merge.queue (null)
      com.atlassian.bitbucket.AuthorisationException: You are not permitted to access this resource
      	at com.atlassian.stash.internal.aop.ExceptionRewriteAdvice.afterThrowing(ExceptionRewriteAdvice.java:37)
      	at com.atlassian.bitbucket.internal.mergequeue.DefaultMergeQueueSettingsService$5.visit(DefaultMergeQueueSettingsService.java:491)
      	at com.atlassian.bitbucket.internal.mergequeue.DefaultMergeQueueSettingsService$5.visit(DefaultMergeQueueSettingsService.java:475)
      	at com.atlassian.bitbucket.scope.RepositoryScope.accept(RepositoryScope.java:26)
      	at com.atlassian.bitbucket.internal.mergequeue.DefaultMergeQueueSettingsService.validateReadPermissions(DefaultMergeQueueSettingsService.java:475)
      	at com.atlassian.bitbucket.internal.mergequeue.DefaultMergeQueueSettingsService.getEffectiveSettings(DefaultMergeQueueSettingsService.java:202)
      	at com.atlassian.bitbucket.web.conditions.RepositoryMergeQueueEnabledCondition.shouldDisplay(RepositoryMergeQueueEnabledCondition.java:46)
      	at com.atlassian.plugin.web.conditions.AndCompositeCondition.shouldDisplay(AndCompositeCondition.java:16)
      	at com.atlassian.plugin.web.impl.DefaultWebInterfaceManager.filterFragmentsByCondition(DefaultWebInterfaceManager.java:187)
      

      Error 2 - Repository Archived Banner condition (WebFragmentSupport):

      Affected Web Fragments:

      • com.atlassian.bitbucket.server.bitbucket-server-web-fragments:bitbucket.repository.nav.merge.queue
      • com.atlassian.bitbucket.server.bitbucket-server-web-fragments:repository-archived-banner

      Workaround

      Configure log filtering in the Bitbucket home directory (<BITBUCKET_HOME>/shared/data/log-properties/) to suppress or reduce the log level for com.atlassian.plugin.web.impl.DefaultWebInterfaceManager and com.atlassian.stash.internal.web.fragments.WebFragmentSupport to avoid excessive disk usage.

      If the Merge Queue feature was not unboarded yet as it requires explicit configuration and onboarding before it can be used, you can safely suppress the error by adding the following to your bitbucket.properties file:

      feature.merge.queue=false
      

      After making this change, please restart your Bitbucket instance for it to take effect.

              Assignee:
              Unassigned
              Reporter:
              Rahul Roy
              Votes:
              1 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: