Package org.apache.juneau.microservice.examples

Class DirectoryResource

java.lang.Object
jakarta.servlet.GenericServlet
jakarta.servlet.http.HttpServlet
org.apache.juneau.rest.server.servlet.RestServlet
org.apache.juneau.rest.server.servlet.BasicRestServlet
org.apache.juneau.microservice.examples.DirectoryResource
All Implemented Interfaces:
jakarta.servlet.Servlet, jakarta.servlet.ServletConfig, Serializable, BasicUniversalConfig, DefaultConfig, DefaultHtmlConfig
public class DirectoryResource extends BasicRestServlet
REST resource that allows access to a file system directory.

The root directory is specified in one of two ways:

  • Specifying the location via a DirectoryResource.rootDir property.
  • Overriding the getRootDir() method.

Files are listed with view and download links, which reach the VIEW and DOWNLOAD operations through ?method=. Both are declared read=true. Deleting a file needs a real DELETE, for example:

curl -X DELETE http://localhost:10000/<mount-path>/foo.txt

Read/write access control is handled through the following properties:

  • DirectoryResource.allowViews - If true, allows view and download access to files.
  • DirectoryResource.allowUploads - If true, allows files to be created or overwritten.
  • DirectoryResource.allowDeletes - If true, allows files to be deleted.

Note: the method query parameter is accepted only for HEAD, OPTIONS and the two read verbs VIEW and DOWNLOAD, so a link can view or download a file but never change one. A subclass that widens allowedMethodParams still can't turn a GET into a write: the router refuses any override of a GET to a method that is not a read. Uploads and deletes still change files, so put the resource behind a CSRF boundary before mounting it anywhere a browser can reach. A boundary judges a ?method=VIEW or ?method=DOWNLOAD link as a write and refuses it, so behind one the listing's links stop working; send real VIEW or DOWNLOAD requests instead.

See Also: