dev@jersey.java.net

Re: [Jersey] Require SSL on a per-method basis?

From: Paul Sandoz <Paul.Sandoz_at_Sun.COM>
Date: Thu, 22 Apr 2010 10:16:07 +0200

On Apr 22, 2010, at 4:52 AM, James Russo wrote:

> Paul,
>
> This has been opened under issue 512 with patch attached. Feel free
> to adjust things as you see fit. It's a simple addition.

Great. We will integrate this after the 1.2 release.


> May want a new package for annotations? Sorry no unit tests, not
> sure how to really unit test that thing with isSecure() from the
> container?
>

See:

   com.sun.jersey.impl.container.grizzly.web.RolesAllowedTest

in the jersey-test module. It will show you how to fake a
SecurityContext implementation.

Paul.


> thanks,
>
> -jr
>
> On Apr 14, 2010, at 11:55 AM, Paul Sandoz wrote:
>
>>
>> On Apr 14, 2010, at 2:43 PM, James Russo wrote:
>>
>>> Paul,
>>>
>>> Any suggestions on annotation names?
>>
>> What about @Secure ? shorter :-)
>>
>> Perhaps one could use @PermitNotSecure to override on a method
>> @Secure on the class?
>>
>>
>>> I've basically mirrored my implementation against the
>>> RolesRequired with a ResourceFilterFactory and an annotation
>>> called "SecureTransportRequired" and
>>> SecureTransportRequiredResourceFilterFactory..
>>>
>>> Is there an existing example I can look at when implementing at
>>> the class level? I don't think the am.isAnnotationPresent() looks
>>> at the class level annotation does it?
>>>
>>
>> No. Do:
>>
>> am.getResource().isAnnotationPresent(...)
>>
>> See the source for RolesAllowedResourceFilterFactory#143
>>
>> Paul.
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe_at_jersey.dev.java.net
>> For additional commands, e-mail: dev-help_at_jersey.dev.java.net
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe_at_jersey.dev.java.net
> For additional commands, e-mail: dev-help_at_jersey.dev.java.net
>