public class SecureRequestCustomizer extends java.lang.Object implements HttpConfiguration.Customizer
Customizer that extracts the attribute from an SSLContext
and sets them on the request with ServletRequest.setAttribute(String, Object)
according to Servlet Specification Requirements.
Modifier and Type | Class and Description |
---|---|
private static class |
SecureRequestCustomizer.CachedInfo
Simple bundle of information that is cached in the SSLSession.
|
Modifier and Type | Field and Description |
---|---|
private boolean |
_sniHostCheck |
private boolean |
_sniRequired |
private HttpField |
_stsField |
private boolean |
_stsIncludeSubDomains |
private long |
_stsMaxAge |
static java.lang.String |
CACHED_INFO_ATTR
The name of the SSLSession attribute that will contain any cached information.
|
private static Logger |
LOG |
private java.lang.String |
sslSessionAttribute |
Constructor and Description |
---|
SecureRequestCustomizer() |
SecureRequestCustomizer(boolean sniHostCheck) |
SecureRequestCustomizer(boolean sniRequired,
boolean sniHostCheck,
long stsMaxAgeSeconds,
boolean stsIncludeSubdomains) |
SecureRequestCustomizer(boolean sniHostCheck,
long stsMaxAgeSeconds,
boolean stsIncludeSubdomains) |
Modifier and Type | Method and Description |
---|---|
void |
customize(Connector connector,
HttpConfiguration channelConfig,
Request request) |
protected void |
customize(javax.net.ssl.SSLEngine sslEngine,
Request request)
Customizes the request attributes to be set for SSL requests.
|
protected void |
customizeSecure(Request request)
Customizes the request attributes for general secure settings.
|
private void |
formatSTS() |
private java.security.cert.X509Certificate[] |
getCertChain(Request request,
javax.net.ssl.SSLSession sslSession) |
java.lang.String |
getSslSessionAttribute() |
long |
getStsMaxAge() |
boolean |
isSniHostCheck() |
boolean |
isSniRequired() |
boolean |
isStsIncludeSubDomains() |
void |
setSniHostCheck(boolean sniHostCheck) |
void |
setSniRequired(boolean sniRequired) |
void |
setSslSessionAttribute(java.lang.String attribute) |
void |
setStsIncludeSubDomains(boolean stsIncludeSubDomains) |
void |
setStsMaxAge(long stsMaxAgeSeconds)
Set the Strict-Transport-Security max age.
|
void |
setStsMaxAge(long period,
java.util.concurrent.TimeUnit units)
Convenience method to call
setStsMaxAge(long) |
java.lang.String |
toString() |
private static final Logger LOG
public static final java.lang.String CACHED_INFO_ATTR
private java.lang.String sslSessionAttribute
private boolean _sniRequired
private boolean _sniHostCheck
private long _stsMaxAge
private boolean _stsIncludeSubDomains
private HttpField _stsField
public SecureRequestCustomizer()
public SecureRequestCustomizer(@Name(value="sniHostCheck") boolean sniHostCheck)
public SecureRequestCustomizer(@Name(value="sniHostCheck") boolean sniHostCheck, @Name(value="stsMaxAgeSeconds") long stsMaxAgeSeconds, @Name(value="stsIncludeSubdomains") boolean stsIncludeSubdomains)
sniHostCheck
- True if the SNI Host name must match.stsMaxAgeSeconds
- The max age in seconds for a Strict-Transport-Security response header. If set less than zero then no header is sent.stsIncludeSubdomains
- If true, a include subdomain property is sent with any Strict-Transport-Security headerpublic SecureRequestCustomizer(@Name(value="sniRequired") boolean sniRequired, @Name(value="sniHostCheck") boolean sniHostCheck, @Name(value="stsMaxAgeSeconds") long stsMaxAgeSeconds, @Name(value="stsIncludeSubdomains") boolean stsIncludeSubdomains)
sniRequired
- True if a SNI certificate is required.sniHostCheck
- True if the SNI Host name must match.stsMaxAgeSeconds
- The max age in seconds for a Strict-Transport-Security response header. If set less than zero then no header is sent.stsIncludeSubdomains
- If true, a include subdomain property is sent with any Strict-Transport-Security headerpublic boolean isSniHostCheck()
public void setSniHostCheck(boolean sniHostCheck)
sniHostCheck
- True if the SNI Host name must match when there is an SNI certificate.public boolean isSniRequired()
SslContextFactory.Server#isSniRequired()
public void setSniRequired(boolean sniRequired)
sniRequired
- True if SNI is required, else requests will be rejected with 400 response.SslContextFactory.Server#setSniRequired(boolean)
public long getStsMaxAge()
public void setStsMaxAge(long stsMaxAgeSeconds)
stsMaxAgeSeconds
- The max age in seconds for a Strict-Transport-Security response header. If set less than zero then no header is sent.public void setStsMaxAge(long period, java.util.concurrent.TimeUnit units)
setStsMaxAge(long)
period
- The period in unitsunits
- The TimeUnit
of the periodpublic boolean isStsIncludeSubDomains()
public void setStsIncludeSubDomains(boolean stsIncludeSubDomains)
stsIncludeSubDomains
- If true, a include subdomain property is sent with any Strict-Transport-Security headerprivate void formatSTS()
public void customize(Connector connector, HttpConfiguration channelConfig, Request request)
customize
in interface HttpConfiguration.Customizer
protected void customizeSecure(Request request)
Request.setSecure(boolean)
with true
and sets a response header if the Strict-Transport-Security options
are set.request
- the request being customizedprotected void customize(javax.net.ssl.SSLEngine sslEngine, Request request)
Customizes the request attributes to be set for SSL requests.
The requirements of the Servlet specs are:
sslEngine
- the sslEngine to be customized.request
- HttpRequest to be customized.private java.security.cert.X509Certificate[] getCertChain(Request request, javax.net.ssl.SSLSession sslSession)
public void setSslSessionAttribute(java.lang.String attribute)
public java.lang.String getSslSessionAttribute()
public java.lang.String toString()
toString
in class java.lang.Object