Specify a list of protected HTTP methods for secure web services

• Key: OPENEJB-981
• Type: Improvement
• Status: Resolved
• Resolution: Fixed
• Priority: Major
• Assignee: Jarek Gawor
• Reporter: Jarek Gawor
• Component/s: configuration, deployment, integration, webservices
• Affects Version/s: 3.1.1
• Fix Version/s: 3.1.1

Description

For secure web services we would like to specify a list of HTTP methods that should be secured. For example, we would like to secure POST requests but leave GET requests unsecured (for WSDL access). See GERONIMO-4015 for a bit more info.

Comments

[Jarek Gawor]

A patch for openejb-jee module that updates the DD types to add an optional http-method element which can be used to specify a list of HTTP methods that must be secured.
The assumption is that if there are no http-method elements in the DD all HTTP methods are automatically secured.

[Jacek Laskowski]

Why is there httpMethod not httpMethods (plural)?

[Jarek Gawor]

Because 1) you specify it as multiple elements (not a single one), for example:

<http-method>POST</http-method>
<http-method>GET</http-method>

instead of:

<http-methods>POST GET PUT</http-method>

and 2) it matches the name of the element in the web.xml schema (see http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd) which provides the same type of functionality for servlets, jsps, etc.

[Jacek Laskowski]

Patch applied in 732158. Thanks Jarek!