Package org.eclipse.jetty.security

Class SecurityHandler.PathMapped

java.lang.Object
org.eclipse.jetty.util.component.AbstractLifeCycle
org.eclipse.jetty.util.component.ContainerLifeCycle
org.eclipse.jetty.server.Handler.Abstract
org.eclipse.jetty.server.Handler.AbstractContainer
org.eclipse.jetty.server.Handler.Wrapper
org.eclipse.jetty.security.SecurityHandler
org.eclipse.jetty.security.SecurityHandler.PathMapped
All Implemented Interfaces:
Comparator<PathSpec>, Authenticator.Configuration, Handler, Handler.Container, Handler.Singleton, Request.Handler, Container, Destroyable, Dumpable, Dumpable.DumpableContainer, LifeCycle, Invocable
Enclosing class:
SecurityHandler
public static class SecurityHandler.PathMapped extends SecurityHandler implements Comparator<PathSpec>

A concrete implementation of SecurityHandler that uses a PathMappings to match request to a list of Constraints, which are applied in the order of least significant to most significant.

An example of using this class is: 


 SecurityHandler.PathMapped handler = new SecurityHandler.PathMapped();
 handler.put("/*", Constraint.combine(Constraint.FORBIDDEN, Constraint.SECURE_TRANSPORT));
 handler.put("", Constraint.ALLOWED);
 handler.put("/login", Constraint.ALLOWED);
 handler.put("*.png", Constraint.ANY_TRANSPORT);
 handler.put("/admin/*", Constraint.from("admin", "operator"));
 handler.put("/admin/super/*", Constraint.from("operator"));
 handler.put("/user/*", Constraint.ANY_USER);
 handler.put("*.xml", Constraint.FORBIDDEN);

When getConstraint(String, Request) is called, any matching constraints are sorted into least to most significant with compare(PathSpec, PathSpec), resulting in the order in which Constraint.combine(Constraint, Constraint) will be applied. For example:

If there is no match for the request path, then the constraint is assumed to be Constraint.ALLOWED.

It is therefore good practice to always explicitly configure a constraint for path /* or /.