Package org.apache.juneau.console.bus.websocket

Class BusWebSocketConfigurator

java.lang.Object

jakarta.websocket.server.ServerEndpointConfig.Configurator

org.apache.juneau.console.bus.websocket.BusWebSocketConfigurator

public final class BusWebSocketConfigurator
extends jakarta.websocket.server.ServerEndpointConfig.Configurator

The handshake guards of the bus's WebSocket endpoint (Origin, Host, fetch-site and capability checks). Not for direct use: it is public only because the container calls it. BusWebSockets.register(jakarta.servlet.ServletContext, org.apache.juneau.console.bus.ServerBus) installs it.

• checkOrigin(String): runs before any upgrade, and a refusal is the container's 403. Under a LoopbackBoundary or allowedOrigins it is an exact match. Under a CsrfBoundary it can only see the Origin value, so it refuses a missing value, null, and anything that is not a well-formed http(s) origin; a well-formed cross-site value passes it and is refused by the next step.
• modifyHandshake(jakarta.websocket.server.ServerEndpointConfig, jakarta.websocket.server.HandshakeRequest, jakarta.websocket.HandshakeResponse): under a LoopbackBoundary, Host against the boundary's authority; under a CsrfBoundary, CsrfBoundary.checkHandshake(String, HandshakeHosts, Map) with the scheme of the handshake's request URI and its headers (so trusted forwarding, when set, sees the forwarded headers). Over HTTP/2 (RFC 8441), where the handshake has no Host, Sec-WebSocket-Key or Upgrade, the request URI's authority stands in for Host (HandshakeHosts). Otherwise Sec-Fetch-Site (when present) must be same-origin. Last, the capability and principal. A failure is recorded in the per-connection user properties, and BusWebSocketEndpoint.onOpen(jakarta.websocket.Session, jakarta.websocket.EndpointConfig) closes at once with 4403 (bus:refused) or 4401 (bus:unknown-session).

The session id is read from the request path only. It is never logged.

The refusal and session are stored in the user-properties map of the handshake, which relies on the container giving each handshake its own copy of that map (WebSocket 2.1 and later; Jetty and Tomcat do). A container that shares one map across handshakes would mix up concurrent connections.

With trustedProxies set, the handshake's peer is read from the Jetty user property jakarta.websocket.endpoint.remoteAddress. Jakarta WebSocket has no standard peer address; a container that records none (Tomcat) leaves the peer unknown, and an unknown peer is not trusted, so a handshake that carries a forwarded host is refused there. The property is believable only because Jetty writes it into the per-handshake copy of the user properties; a container that copied client input into it would break that.

Trusted forwarding selects a hop by counting entries from the right, which relies on the container returning the repeated lines of a forwarded header in the order they arrived on the wire. Jetty and Tomcat both do. A container that reorders them would select the wrong hop.

Example:

// Do not construct this class; register the endpoint instead: BusWebSockets.register(servletContext, JobsRest.BUS);

Since:

10.0.0

Method Summary

Modifier and Type	Method	Description
boolean	checkOrigin(String originHeaderValue)
<T> T	getEndpointInstance(Class<T> endpointClass)
void	modifyHandshake(jakarta.websocket.server.ServerEndpointConfig sec, jakarta.websocket.server.HandshakeRequest request, jakarta.websocket.HandshakeResponse response)

Methods inherited from class jakarta.websocket.server.ServerEndpointConfig.Configurator

getContainerDefaultConfigurator, getNegotiatedExtensions, getNegotiatedSubprotocol

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

checkOrigin

public boolean checkOrigin(String originHeaderValue)

Overrides:

checkOrigin in class jakarta.websocket.server.ServerEndpointConfig.Configurator

modifyHandshake

public void modifyHandshake(jakarta.websocket.server.ServerEndpointConfig sec,
 jakarta.websocket.server.HandshakeRequest request,
 jakarta.websocket.HandshakeResponse response)

Overrides:

modifyHandshake in class jakarta.websocket.server.ServerEndpointConfig.Configurator

getEndpointInstance

public <T> T getEndpointInstance(Class<T> endpointClass)
                          throws InstantiationException

Overrides:

getEndpointInstance in class jakarta.websocket.server.ServerEndpointConfig.Configurator

Throws:

InstantiationException