Module io.inverno.mod.security.http
The Inverno framework HTTP security module provides support for securing access to HTTP endpoints.
This module extends the security module and provides components to secure services and resources accessed by HTTP. It provides:
- basic HTTP authentication (RFC 7617)
- digest HTTP authentication (RFC 7616)
- token based authentication
- Cross-origin resource sharing (CORS) as defined by HTTP CORS protocol
- Cross-site request forgery attack protection
HTTP endpoints are protected using combinations of security interceptors. More specifically, the SecurityInterceptor shall always be used on protected services
or resources, just like the SecurityManager, its role is to authenticate the credentials provided in the request and creates the security context in the exchange
context. An AccessControlInterceptor can then be used to control the access to the protected services or resources using the security context. An
AuthenticationErrorInterceptor can be used to intercept UNAUTHORIZED(401) errors and request for authentication. For instance, such interceptor can send
HTTP basic or digest challenges in the response or it can redirect the client to a login form.
- Since:
- 1.5
- Author:
- Jeremy Kuhn
-
Packages
ExportsPackageDescriptionInverno HTTP security API.Inverno HTTP basic authentication.Inverno HTTP security context API.Inverno CORS security.Inverno CSRF security.Inverno HTTP digest authentication.Inverno HTTP form authentication.Inverno HTTP login API.Inverno HTTP token authentication.Indirect Exports -
Modules
RequiresModifierModuleDescriptiontransitiveThe Inverno framework HTTP server module provides an HTTP1.x and HTTP/2 server.transitiveThe Inverno framework security module provides general support to secure access to protected service or resources in an application.Indirect RequiresModifierModuleDescriptiontransitiveThe Inverno framework HTTP base module defines base APIs and services for HTTP client and server implementations.