Package org.apache.juneau.rest.server.guard

Class DenyAllGuard

java.lang.Object
org.apache.juneau.rest.server.guard.RestGuard
org.apache.juneau.rest.server.guard.DenyAllGuard
public class DenyAllGuard extends RestGuard
Deny-all RestGuard — rejects every request with 403 Forbidden.

Used as the secure-by-default placeholder on operations or resources that require an authentication / authorization chain the importer must explicitly opt into. Without the importer's override, every request is denied; once a user-supplied @Bean RestGuardList is registered on the resource, the framework's bean-store override seam replaces the entire annotation-derived guard list (including this deny-all) with the user-supplied chain — see the RestOpContext.guards memoizer for the full lookup contract.

Composition example:

// Default-deny on a resource until the importer wires up auth. @Rest(path="/admin", guards=DenyAllGuard.class) public class AdminResource extends RestServlet { // Importer opt-in: register a guard chain that allows authorized callers through. @Bean(name="guards") public RestGuardList guards(BeanStore bs) { return RestGuardList.create(bs) .append(new MyAuthGuard()) .build(); } }

See Also:
Since:
10.0.0

  • Constructor Details

  • Method Details

    • isRequestAllowed

      public boolean isRequestAllowed(RestRequest req)
      Description copied from class: RestGuard
      Returns true if the specified request can pass through this guard.
      Specified by:
      isRequestAllowed in class RestGuard
      Parameters:
      req - The servlet request.
      Returns:
      true if the specified request can pass through this guard.