Fix webengine to allow unauthenticated access using openurl

1. use the attached project either with an SDK or build the jar with mvn clean install
2. The following contribution is in the project and allows to acces a url when not authenticated:

   <extension target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService" point="openUrl">
           <openUrl name="monmodule">
               <grantPattern>${org.nuxeo.ecm.contextPath}/site/monmodule</grantPattern>
           </openUrl>
           <openUrl name="monmodule2">
               <grantPattern>${org.nuxeo.ecm.contextPath}/site/monmodule/.*</grantPattern>
           </openUrl>
       </extension>
   

3. deploy the app to a nuxeo 6.0
4. access the {$nuxeo-url}/nuxeo/site/monmodule or access the {$nuxeo-url}/nuxeo/site/monmodule/
5. this works fine
6. now do the same with a 7.10 version
7. it gives the following stack:

   2016-08-10 11:12:23,723 ERROR [http-bio-0.0.0.0-8180-exec-3] [org.nuxeo.ecm.platform.web.common.exceptionhandling.DefaultNuxeoExceptionHandler] java.lang.IllegalStateException: Not authenticated user is trying to get a core session
   	at org.nuxeo.ecm.webengine.jaxrs.session.CoreSessionProvider.createSession(CoreSessionProvider.java:59)
   	at org.nuxeo.ecm.webengine.jaxrs.session.CoreSessionProvider.getSessionRef(CoreSessionProvider.java:47)
   	at org.nuxeo.ecm.webengine.jaxrs.session.CoreSessionProvider.getSession(CoreSessionProvider.java:54)
   	at org.nuxeo.ecm.webengine.jaxrs.session.SessionFactory.getSession(SessionFactory.java:88)
   	at org.nuxeo.ecm.webengine.jaxrs.session.SessionFactory.getSession(SessionFactory.java:84)
   	at org.nuxeo.ecm.webengine.jaxrs.coreiodelegate.RenderingContextWebUtils.fillContext(RenderingContextWebUtils.java:114)
   	at org.nuxeo.ecm.webengine.jaxrs.coreiodelegate.RenderingContextWebUtils.getContext(RenderingContextWebUtils.java:62)
   	at org.nuxeo.ecm.webengine.jaxrs.coreiodelegate.PartialCoreIODelegate.isWriteable(PartialCoreIODelegate.java:86)
   	at com.sun.jersey.core.spi.factory.MessageBodyFactory._getMessageBodyWriter(MessageBodyFactory.java:395)
   	at com.sun.jersey.core.spi.factory.MessageBodyFactory._getMessageBodyWriter(MessageBodyFactory.java:376)
   	at com.sun.jersey.core.spi.factory.MessageBodyFactory.getMessageBodyWriter(MessageBodyFactory.java:359)
   	at com.sun.jersey.spi.container.ContainerResponse.write(ContainerResponse.java:267)
   	at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1510)
   	at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419)
   	at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409)
   	at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409)
   	at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:558)
   	at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:733)
   	at org.nuxeo.ecm.webengine.app.jersey.WebEngineServlet.containerService(WebEngineServlet.java:171)
   	at org.nuxeo.ecm.webengine.app.jersey.WebEngineServlet.service(WebEngineServlet.java:148)
   	at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.webengine.jaxrs.session.SessionCleanupFilter.run(SessionCleanupFilter.java:43)
   	at org.nuxeo.ecm.webengine.jaxrs.HttpFilter.doFilter(HttpFilter.java:42)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.webengine.app.WebEngineFilter.doFilter(WebEngineFilter.java:92)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.webengine.jaxrs.context.RequestContextFilter.run(RequestContextFilter.java:41)
   	at org.nuxeo.ecm.webengine.jaxrs.HttpFilter.doFilter(HttpFilter.java:42)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.requestcontroller.filter.NuxeoThreadTrackerFilter.doFilter(NuxeoThreadTrackerFilter.java:28)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.core.management.jtajca.internal.Log4jWebFilter.doFilter(Log4jWebFilter.java:67)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.ui.web.rest.FancyURLFilter.doFilter(FancyURLFilter.java:118)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.requestcontroller.filter.NuxeoRequestControllerFilter.doFilter(NuxeoRequestControllerFilter.java:140)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.webdav.service.WIRequestFilter.doFilter(WIRequestFilter.java:59)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter.doFilterInternal(NuxeoAuthenticationFilter.java:414)
   	at org.nuxeo.ecm.platform.ui.web.auth.service.NuxeoAuthFilterChain.doFilter(NuxeoAuthFilterChain.java:36)
   	at org.nuxeo.ecm.platform.ui.web.auth.oauth.NuxeoOAuthFilter.doFilter(NuxeoOAuthFilter.java:120)
   	at org.nuxeo.ecm.platform.ui.web.auth.service.NuxeoAuthFilterChain.doFilter(NuxeoAuthFilterChain.java:34)
   	at org.nuxeo.ecm.platform.ui.web.auth.oauth2.NuxeoOAuth2Filter.doFilter(NuxeoOAuth2Filter.java:68)
   	at org.nuxeo.ecm.platform.ui.web.auth.service.NuxeoAuthFilterChain.doFilter(NuxeoAuthFilterChain.java:34)
   	at org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter.doFilter(NuxeoAuthenticationFilter.java:400)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.requestcontroller.filter.NuxeoCorsFilter.doFilter(NuxeoCorsFilter.java:49)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.exceptionhandling.NuxeoExceptionFilter.doFilter(NuxeoExceptionFilter.java:75)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.nuxeo.ecm.platform.web.common.encoding.NuxeoEncodingFilter.doFilter(NuxeoEncodingFilter.java:73)
   	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
   	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
   	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
   	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
   	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
   	at org.nuxeo.runtime.tomcat.dev.DevValve.invoke(DevValve.java:67)
   	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
   	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
   	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
   	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)
   	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)
   	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)
   	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
   	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
   	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
   	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
   	at java.lang.Thread.run(Thread.java:745)
   

This is indeed due to

CoreSession session = SessionFactory.getSession(webRequest);

in RenderingContextBuilder.fillContext.

It seems the delegate is registered in marshaller-contrib.xml but there does not appear to be any alternative, meaning no way to access without being authenticated and get a JSON output.

Please also note that using the following:

@Produces({ MediaType.TEXT_HTML, MediaType.APPLICATION_JSON })

instead of

@Produces("application/json;charset=UTF-8")

produces HTML instead of JSON do not request any authentication.