Module org.eclipse.jetty.server

Package org.eclipse.jetty.server

Class SecureRequestCustomizer

java.lang.Object

org.eclipse.jetty.server.SecureRequestCustomizer

All Implemented Interfaces:

HttpConfiguration.Customizer

public class SecureRequestCustomizer
extends Object
implements HttpConfiguration.Customizer

Customizer that extracts the attribute from an SSLContext and sets them on the request with Attributes.setAttribute(String, Object) according to Servlet Specification Requirements.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
protected static class	SecureRequestCustomizer.SecureRequest
protected class	SecureRequestCustomizer.SecureRequestWithTLSData
static final record	SecureRequestCustomizer.SslSessionData	Simple bundle of data that is cached in the SSLSession.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CIPHER_SUITE_ATTRIBUTE	The request attribute name to use to obtain the cipher suite name.
static final String	DEFAULT_SSL_SESSION_ATTRIBUTE	The default value of the request attribute name to use to obtain the SSLSession object.
static final String	DEFAULT_SSL_SESSION_DATA_ATTRIBUTE	The default value of the request attribute name to use to obtain the SecureRequestCustomizer.SslSessionData object.
static final String	KEY_SIZE_ATTRIBUTE	The request attribute name to use to obtain the key size.
static final String	PEER_CERTIFICATES_ATTRIBUTE	The request attribute name to use to obtain the peer certificate chain as an array of X509Certificate objects.
static final String	SSL_SESSION_ID_ATTRIBUTE	The request attribute name to use to obtain the SSLSession.getId().
static final String	X509_ATTRIBUTE	The request attribute name to use to obtain the local certificate as an X509 object.

Constructor Summary

Constructors

Constructor	Description
SecureRequestCustomizer()
SecureRequestCustomizer(boolean sniHostCheck)
SecureRequestCustomizer(boolean sniRequired, boolean sniHostCheck, long stsMaxAgeSeconds, boolean stsIncludeSubdomains)
SecureRequestCustomizer(boolean sniHostCheck, long stsMaxAgeSeconds, boolean stsIncludeSubdomains)

Method Summary

Modifier and Type	Method	Description
protected void	checkSni(Request request, SSLSession session)
Request	customize(Request request, org.eclipse.jetty.http.HttpFields.Mutable responseHeaders)
String	getSslSessionAttribute()
String	getSslSessionDataAttribute()
long	getStsMaxAge()
boolean	isSniHostCheck()
boolean	isSniRequired()
boolean	isStsIncludeSubDomains()
protected Request	newSecureRequest(Request request, SSLEngine sslEngine)
void	setSniHostCheck(boolean sniHostCheck)
void	setSniRequired(boolean sniRequired)
void	setSslSessionAttribute(String attribute)
void	setStsIncludeSubDomains(boolean stsIncludeSubDomains)
void	setStsMaxAge(long stsMaxAgeSeconds)	Sets the Strict-Transport-Security max age in seconds.
void	setStsMaxAge(long period, TimeUnit units)	Sets the Strict-Transport-Security max age in the given time unit.
String	toString()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Details

CIPHER_SUITE_ATTRIBUTE

public static final String CIPHER_SUITE_ATTRIBUTE

The request attribute name to use to obtain the cipher suite name.

See Also:

• Constant Field Values

KEY_SIZE_ATTRIBUTE

public static final String KEY_SIZE_ATTRIBUTE

The request attribute name to use to obtain the key size.

See Also:

• Constant Field Values

SSL_SESSION_ID_ATTRIBUTE

public static final String SSL_SESSION_ID_ATTRIBUTE

The request attribute name to use to obtain the SSLSession.getId().

See Also:

• Constant Field Values

PEER_CERTIFICATES_ATTRIBUTE

public static final String PEER_CERTIFICATES_ATTRIBUTE

The request attribute name to use to obtain the peer certificate chain as an array of X509Certificate objects.

See Also:

• Constant Field Values

X509_ATTRIBUTE

public static final String X509_ATTRIBUTE

The request attribute name to use to obtain the local certificate as an X509 object.

See Also:

• Constant Field Values

DEFAULT_SSL_SESSION_ATTRIBUTE

public static final String DEFAULT_SSL_SESSION_ATTRIBUTE

The default value of the request attribute name to use to obtain the SSLSession object.

See Also:

• setSslSessionAttribute(String)
• Constant Field Values

DEFAULT_SSL_SESSION_DATA_ATTRIBUTE

public static final String DEFAULT_SSL_SESSION_DATA_ATTRIBUTE

The default value of the request attribute name to use to obtain the SecureRequestCustomizer.SslSessionData object.

See Also:

• getSslSessionDataAttribute()

Constructor Details

SecureRequestCustomizer

public SecureRequestCustomizer()

SecureRequestCustomizer

public SecureRequestCustomizer(@Name("sniHostCheck")
 boolean sniHostCheck)

SecureRequestCustomizer

public SecureRequestCustomizer(@Name("sniHostCheck")
 boolean sniHostCheck,
 @Name("stsMaxAgeSeconds")
 long stsMaxAgeSeconds,
 @Name("stsIncludeSubdomains")
 boolean stsIncludeSubdomains)

Parameters:

sniHostCheck - True if the SNI Host name must match.

stsMaxAgeSeconds - The max age in seconds for a Strict-Transport-Security response header. If set less than zero then no header is sent.

stsIncludeSubdomains - If true, a include subdomain property is sent with any Strict-Transport-Security header

SecureRequestCustomizer

public SecureRequestCustomizer(@Name("sniRequired")
 boolean sniRequired,
 @Name("sniHostCheck")
 boolean sniHostCheck,
 @Name("stsMaxAgeSeconds")
 long stsMaxAgeSeconds,
 @Name("stsIncludeSubdomains")
 boolean stsIncludeSubdomains)

Parameters:

sniRequired - True if a SNI certificate is required.

sniHostCheck - True if the SNI Host name must match.

stsMaxAgeSeconds - The max age in seconds for a Strict-Transport-Security response header. If set less than zero then no header is sent.

stsIncludeSubdomains - If true, a include subdomain property is sent with any Strict-Transport-Security header

Method Details

isSniHostCheck

public boolean isSniHostCheck()

Returns:

True if the SNI Host name must match when there is an SNI certificate.

setSniHostCheck

public void setSniHostCheck(boolean sniHostCheck)

Parameters:

sniHostCheck - True if the SNI Host name must match when there is an SNI certificate.

isSniRequired

public boolean isSniRequired()

Returns:

True if SNI is required, else requests will be rejected with 400 response.

See Also:

• SslContextFactory.Server.isSniRequired()

setSniRequired

public void setSniRequired(boolean sniRequired)

Parameters:

sniRequired - True if SNI is required, else requests will be rejected with 400 response.

See Also:

• SslContextFactory.Server.setSniRequired(boolean)

getStsMaxAge

public long getStsMaxAge()

Returns:

The max age in seconds for a Strict-Transport-Security response header. If set less than zero then no header is sent.

setStsMaxAge

public void setStsMaxAge(long stsMaxAgeSeconds)

Sets the Strict-Transport-Security max age in seconds.

Parameters:

stsMaxAgeSeconds - the max age in seconds for the Strict-Transport-Security response header. If less than zero then no Strict-Transport-Security response header is set.

setStsMaxAge

public void setStsMaxAge(long period,
 TimeUnit units)

Sets the Strict-Transport-Security max age in the given time unit.

Parameters:

period - The max age value

units - The TimeUnit of the max age

isStsIncludeSubDomains

public boolean isStsIncludeSubDomains()

Returns:

whether the includeSubdomains attribute is sent with the Strict-Transport-Security response header

setStsIncludeSubDomains

public void setStsIncludeSubDomains(boolean stsIncludeSubDomains)

Parameters:

stsIncludeSubDomains - whether the includeSubdomains attribute is sent with the Strict-Transport-Security response header

customize

public Request customize(Request request,
 org.eclipse.jetty.http.HttpFields.Mutable responseHeaders)

Specified by:

customize in interface HttpConfiguration.Customizer

newSecureRequest

protected Request newSecureRequest(Request request,
 SSLEngine sslEngine)

setSslSessionAttribute

public void setSslSessionAttribute(String attribute)

getSslSessionAttribute

public String getSslSessionAttribute()

getSslSessionDataAttribute

public String getSslSessionDataAttribute()

Returns:

getSslSessionAttribute() + "Data"

checkSni

protected void checkSni(Request request,
 SSLSession session)

toString

public String toString()

Overrides:

toString in class Object