Package org.springframework.security.web.access.channel

Class InsecureChannelProcessor

java.lang.Object

org.springframework.security.web.access.channel.InsecureChannelProcessor

All Implemented Interfaces:

org.springframework.beans.factory.InitializingBean, ChannelProcessor

public class InsecureChannelProcessor
extends java.lang.Object
implements org.springframework.beans.factory.InitializingBean, ChannelProcessor

Ensures channel security is inactive by review of HttpServletRequest.isSecure() responses.

The class responds to one case-sensitive keyword, getInsecureKeyword(). If this keyword is detected, HttpServletRequest.isSecure() is used to determine the channel security offered. If channel security is present, the configured ChannelEntryPoint is called. By default the entry point is RetryWithHttpEntryPoint.

The default insecureKeyword is REQUIRES_INSECURE_CHANNEL.

Constructor Summary

Constructors

Constructor	Description
InsecureChannelProcessor()

Method Summary

Modifier and Type	Method	Description
void	afterPropertiesSet()
void	decide(FilterInvocation invocation, java.util.Collection<ConfigAttribute> config)	Decided whether the presented FilterInvocation provides the appropriate level of channel security based on the requested list of ConfigAttributes.
ChannelEntryPoint	getEntryPoint()
java.lang.String	getInsecureKeyword()
void	setEntryPoint(ChannelEntryPoint entryPoint)
void	setInsecureKeyword(java.lang.String secureKeyword)
boolean	supports(ConfigAttribute attribute)	Indicates whether this ChannelProcessor is able to process the passed ConfigAttribute.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

InsecureChannelProcessor

public InsecureChannelProcessor()

Method Detail

afterPropertiesSet

public void afterPropertiesSet()

Specified by:

afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

decide

public void decide(FilterInvocation invocation,
                   java.util.Collection<ConfigAttribute> config)
            throws java.io.IOException,
                   javax.servlet.ServletException

Description copied from interface: ChannelProcessor

Decided whether the presented FilterInvocation provides the appropriate level of channel security based on the requested list of ConfigAttributes.

Specified by:

decide in interface ChannelProcessor

Throws:

java.io.IOException

javax.servlet.ServletException

getEntryPoint

public ChannelEntryPoint getEntryPoint()

getInsecureKeyword

public java.lang.String getInsecureKeyword()

setEntryPoint

public void setEntryPoint(ChannelEntryPoint entryPoint)

setInsecureKeyword

public void setInsecureKeyword(java.lang.String secureKeyword)

supports

public boolean supports(ConfigAttribute attribute)

Description copied from interface: ChannelProcessor

Indicates whether this ChannelProcessor is able to process the passed ConfigAttribute.

This allows the ChannelProcessingFilter to check every configuration attribute can be consumed by the configured ChannelDecisionManager.

Specified by:

supports in interface ChannelProcessor

Parameters:

attribute - a configuration attribute that has been configured against the ChannelProcessingFilter.

Returns:

true if this ChannelProcessor can support the passed configuration attribute