Package org.apache.juneau.rest.server.convention

Class WellKnownMixin

java.lang.Object
org.apache.juneau.rest.server.servlet.RestMixin
org.apache.juneau.rest.server.convention.WellKnownMixin
public class WellKnownMixin extends RestMixin
Mixin that serves RFC 8615 /.well-known/* discovery endpoints.

Sibling of FaviconMixin, SeoMixin, and VersionMixin. All four classes live in the org.apache.juneau.rest.server.convention convention-endpoints mixin pack.

In v1 the mixin mounts a single literal path — /.well-known/security.txt per RFC 9116. The class is structured so that future entries (for example /.well-known/openid-configuration from a separate AuthN mixin pack) can be added without touching this source: each future entry ships its own mixin class with its own @Rest(paths) declaration.

Compose into a host resource via @Rest(mixins=WellKnownMixin.class); the /.well-known/security.txt URL becomes available alongside the host's own endpoints with no further wiring.

Hardcoded mount path:

Unlike the sibling api-docs and ops mixins (see SwaggerMixin, VersionMixin, etc.), the mount path here is not SVL-configurable — /.well-known/security.txt is fixed by RFC 8615 (Well-Known URIs) and RFC 9116 (security.txt). Both RFCs are explicit that the /.well-known/ prefix is the discovery convention and that the filename suffix is the protocol-defined registry key — a runtime override here would make the endpoint undiscoverable by spec-compliant clients.

Mixin-only deployment:

This resource is designed for composition via @Rest(mixins=...). The mount path is pinned at the op level by @RestGet(path="/.well-known/security.txt") on getSecurityTxt(org.apache.juneau.rest.server.RestResponse); a class-level @Rest(paths=...) declaration would be silently ignored under the mixin pattern (see @Rest(paths) Javadoc).

Composition example:

@Rest(path="/api", mixins=WellKnownMixin.class) public class ApiResource extends RestServlet { } // Configure the security.txt body via a @Bean factory: @Bean WellKnownMixin wellKnown() { return WellKnownMixin.create() .securityTxt("Contact: security@example.com\nExpires: 2027-01-01T00:00:00Z\n") .build(); }

Defaults & behavior:
  • No default body. Per RFC 9116, security.txt's mere presence is meaningful; shipping a placeholder body would be misleading. If the builder is not given a body via securityTxt(String), the endpoint returns 404 Not Found (i.e. "we don't have one"). Loud documentation in topic page.
  • Content-Type. text/plain; charset=UTF-8 when a body is configured.
  • Excluded from generated Swagger / OpenAPI specs via @OpSwagger(ignore=true).
See Also:
Since:
10.0.0

  • Constructor Details

    • WellKnownMixin

      public WellKnownMixin()
      No-arg constructor — results in a 404 on /.well-known/security.txt.

    • WellKnownMixin

      protected WellKnownMixin(WellKnownMixin.Builder builder)
      Builder constructor.

      Stashes the programmatic RestBuilder(the builder itself, carrying any @Rest-level overrides such as path) via super(builder) so those values take precedence over this mixin's own @Rest annotation.

      Parameters:
      builder - The builder. Must not be null.

  • Method Details

    • create

      public static WellKnownMixin.Builder create()
      Creates a new builder.
      Returns:
      A new builder.

    • getSecurityTxt

      public void getSecurityTxt(RestResponse res) throws IOException
      [GET /.well-known/security.txt] — emit the configured RFC 9116 body, or 404 when unset.
      Parameters:
      res - The current REST response.
      Throws:
      IOException - If an I/O error occurs while writing the response.
      NotFound - If no security.txt body is configured.

    • getSecurityTxtBody

      public String getSecurityTxtBody()
      Returns the configured security.txt body (test/inspection helper).
      Returns:
      The body, or null if unset.