io.undertow.server.handlers

Class SSLHeaderHandler

java.lang.Object

io.undertow.server.handlers.SSLHeaderHandler

All Implemented Interfaces:

HttpHandler

public class SSLHeaderHandler
extends Object
implements HttpHandler

Handler that sets SSL information on the connection based on the following headers:

• SSL_CLIENT_CERT
• SSL_CIPHER
• SSL_SESSION_ID

If this handler is present in the chain it will always override the SSL session information, even if these headers are not present.

This handler MUST only be used on servers that are behind a reverse proxy, where the reverse proxy has been configured to always set these header for EVERY request (or strip existing headers with these names if no SSL information is present). Otherwise it may be possible for a malicious client to spoof a SSL connection.

Author:

Stuart Douglas

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	SSLHeaderHandler.Builder

Field Summary

Fields

Modifier and Type	Field and Description
static String	HTTPS

Constructor Summary

Constructors

Constructor and Description
SSLHeaderHandler(HttpHandler next)

Method Summary

Modifier and Type	Method and Description
void	handleRequest(HttpServerExchange exchange) Handle the request.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

HTTPS

public static final String HTTPS

See Also:

Constant Field Values

Constructor Detail

SSLHeaderHandler

public SSLHeaderHandler(HttpHandler next)

Method Detail

handleRequest

public void handleRequest(HttpServerExchange exchange)
                   throws Exception

Description copied from interface: HttpHandler

Handle the request.

Specified by:

handleRequest in interface HttpHandler

Parameters:

exchange - the HTTP request/response exchange

Throws:

Exception