Class ConfigResource

java.lang.Object
jakarta.servlet.GenericServlet
jakarta.servlet.http.HttpServlet
All Implemented Interfaces:
jakarta.servlet.Servlet, jakarta.servlet.ServletConfig, Serializable, BasicUniversalConfig, DefaultConfig, DefaultHtmlConfig

public class ConfigResource extends BasicRestServlet
Shows contents of the microservice configuration file, and updates it.

Reads are GETs. Writes are PUTs only, sent by a REST client or from the command line; there is no HTML edit form, because a browser form cannot carry the header-borne token a CSRF boundary requires. A PUT cannot be sent cross-site without a CORS preflight, so a boundary in front of this resource (see AdminBoundary) admits it without a token:

curl -X PUT -H 'Content-Type: text/plain' --data-binary @my.cfg http://localhost:10000/config curl -X PUT -H 'Content-Type: text/plain' -d 'newValue' http://localhost:10000/config/MySection/myKey

A GET returns the whole configuration, including any secrets in it, and this resource has no authentication of its own. Do not expose it on an untrusted network.

See Also: