Q:

GWT's getResults() of SubmitCompleteEvent returns null after submitting form with FileUpload

After successfully implementing a file upload with GWT in one application I tried to transfer this to another application but the string returned from the uploading servlet cannot be retrieved in the provided SubmitCompleteHandler. SubmitCompleteEvent.getResults() just returns null.
A typical reason for returning null seems to be the uploading servlet is in a different domain. But as the GWT and uploading servlet run in the same context it should not be a cross-domain issue.
The FileUpload widget is contained in a FormPanel. When clicking a button the form is submitted. This calls a servlet (really, a breakpoint is reached during debugging). In real world it would store the file on server side and return the filename. In this reduced example it just writes a String to the response Writer.
FormPanel with FileUpload snippet:
final FormPanel form = new FormPanel();
form.setAction("upload"); // results "upload" directly below context
form.setEncoding(FormPanel.ENCODING_MULTIPART);
form.setMethod(FormPanel.METHOD_POST);
VerticalPanel panel = new VerticalPanel();
form.setWidget(panel);
FileUpload upload = new FileUpload();
upload.setName("uploadFormElement");
panel.add(upload);

panel.add(new Button("Submit", new ClickHandler() {
    public void onClick(ClickEvent event) {
        form.submit();
    }
}));
form.addSubmitCompleteHandler(new FormPanel.SubmitCompleteHandler() {
    public void onSubmitComplete(SubmitCompleteEvent event) {
        Window.alert("===> " + event.getResults() + " <==="); // shows "===> null <==="
    }
});

web.xml snippet:
<servlet> 
    <servlet-name>FileUploadServlet</servlet-name>
    <servlet-class>mypackage.FileUploadServlet</servlet-class> 
</servlet> 
<servlet-mapping>
    <servlet-name>FileUploadServlet</servlet-name>
    <url-pattern>/upload</url-pattern> 
</servlet-mapping>

FileUploadServlet snippet:
public class FileUploadServlet extends HttpServlet {

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse response)
            throws ServletException, IOException {

        response.setContentType("text/html");
        response.getWriter().write("OK");
        response.getWriter().flush();
    }

}

Are there any libraries or library versions known to be conflicting with GWT's SubmitCompleteHandler?
Any ideas are appreciated ...
UPDATE: After downgrading all artifacts belonging to spring-security from 4.0.4.RELEASE to 3.2.4.RELEASE it works. With upgrading them to 4.1.2.RELEASE it does not work either.

A:

This issue are related to X-Frame-Options: DENY header, that spring-security 4.x appends to responses [1]. Since GWT application typically loaded in iframe, this header makes not possible to properly handle form submission from client code executed in frame.
To fix issue frame options policy should be disabled or switched to SAMEORIGIN.
E.g. for xml config into <s:http>:
<s:headers>
  <s:frame-options policy="SAMEORIGIN" />
</s:headers>

Or for Java config by using org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.frameOptions():
 HttpSecurity cfg = ...;
 cfg.headers().frameOptions().sameOrigin();

[1] https://docs.spring.io/spring-security/site/docs/current/reference/html/headers.html#headers-frame-options

