Package org.apache.juneau.server.config.rest

Class ConfigApiKeyGuard

java.lang.Object
org.apache.juneau.rest.server.guard.RestGuard
org.apache.juneau.server.config.rest.ConfigApiKeyGuard
public class ConfigApiKeyGuard extends RestGuard
Guard that protects LoadConfigResource with a shared API key.

The expected key is read from the [Security] section of juneau-server-config.cfg:

[Security] apiKey = some-long-random-secret

Clients supply the key in either an Authorization: Bearer <key> header or an X-Api-Key header. The comparison is constant-time (MessageDigest.isEqual(byte[], byte[]) over UTF-8 bytes).

The key is read once, when the guard is created, and the Config used to read it is closed straight away. Changing the key requires a restart.

Requests that did not arrive over a secure channel are refused unless they come from a loopback address or [Security] allowInsecure is true.

The guard fails closed: if no key is configured (missing, empty or unreadable setting), every request is rejected with a 403. The key is never logged or echoed. Always use TLS.

  • Constructor Details

    • ConfigApiKeyGuard

      public ConfigApiKeyGuard()
      Constructor. Reads the settings once and releases the configuration.

  • Method Details

    • guard

      public boolean guard(RestRequest req, RestResponse res) throws BasicHttpException
      Description copied from class: RestGuard
      Checks the current HTTP request and throws a BasicHttpException if the guard does not permit the request.

      By default, throws an SC_FORBIDDEN exception if RestGuard.isRequestAllowed(RestRequest) returns false.

      Subclasses are free to override this method to tailor the behavior of how to handle unauthorized requests.

      Overrides:
      guard in class RestGuard
      Parameters:
      req - The servlet request.
      res - The servlet response.
      Returns:
      true if request can proceed. Specify false if you're doing something like a redirection to a login page.
      Throws:
      BasicHttpException - Thrown to abort processing on current request.

    • isRequestAllowed

      public boolean isRequestAllowed(RestRequest req)
      Description copied from class: RestGuard
      Returns true if the specified request can pass through this guard.
      Specified by:
      isRequestAllowed in class RestGuard
      Parameters:
      req - The servlet request.
      Returns:
      true if the specified request can pass through this guard.

    • configuredKey

      protected String configuredKey()
      Returns the key read at startup, or null if none is configured or the configuration could not be read.
      Returns:
      The configured key, or null.