Package org.apache.juneau.petstore.jetty

Class App.AppConfig

java.lang.Object
org.apache.juneau.petstore.jetty.App.AppConfig
Enclosing class:
App
@Configuration public static class App.AppConfig extends Object
Application-specific configuration class contributing the top-level REST servlet and the console, API and admin boundary filters.

  • Constructor Details

  • Method Details

    • rootResources

      public jakarta.servlet.Servlet rootResources()
      Provides the top-level REST servlet, auto-mounted by JettyServerComponent at Rest.path().
      Returns:
      The root servlet.

    • consoleBoundary

      public ServletFilterRegistration consoleBoundary()
      Provides the console's CSRF boundary, covering /console only.

      The /petstore API is covered by apiBoundary() and the admin resources by adminBoundary(); /petstore-ui is outside all three: see PetstoreConsoleBoundary. It runs ahead of routing and ahead of authentication, for the request, forward, async and error dispatches; the include dispatch is deliberately not mapped. It is built over the same PetstoreApiBoundary that apiBoundary() mounts, so the API token its pages carry is one the API filter accepts.

      Returns:
      The filter registration.

    • apiBoundary

      public ServletFilterRegistration apiBoundary()
      Provides the API's CSRF boundary, covering /petstore/*.

      It runs only on the original request: an internal forward or error dispatch to the API is not a new attacker-controlled request. The order keeps it just behind consoleBoundary(); the two patterns never overlap.

      Returns:
      The filter registration.

    • adminBoundary

      public ServletFilterRegistration adminBoundary()
      Provides the admin resources' CSRF boundary, covering /config, /logs and /shutdown.

      A filter of its own, answering to the host names in "petstore.admin.allowedHosts", or to the loopback names only while that is unset. The admin resources have no forms, so a browser write to them is refused, and command-line writes are admitted: see AdminBoundary. The boundary does not authenticate: the admin resources must not be exposed on an untrusted network.

      Returns:
      The filter registration.
      Throws:
      IllegalArgumentException - If "petstore.admin.allowedHosts" holds an entry that is blank or not a bare host name.