java.lang.Object | |
↳ | org.springframework.security.web.firewall.DefaultHttpFirewall |
Default implementation which wraps requests in order to provide consistent values of the servletPath
and
pathInfo
, which do not contain path parameters (as defined in
RFC 2396). Different servlet containers
interpret the servlet spec differently as to how path parameters are treated and it is possible they might be added
in order to bypass particular security constraints. When using this implementation, they will be removed for all
requests as the request passes through the security filter chain. Note that this means that any segments in the
decoded path which contain a semi-colon, will have the part following the semi-colon removed for
request matching. Your application should not contain any valid paths which contain semi-colons.
If any un-normalized paths are found (containing directory-traversal character sequences), the request will be rejected immediately. Most containers normalize the paths before performing the servlet-mapping, but again this is not guaranteed by the servlet spec.
Public Constructors | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Public Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Provides the request object which will be passed through the filter chain.
| |||||||||||
Provides the response which will be passed through the filter chain.
|
[Expand]
Inherited Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
From class
java.lang.Object
| |||||||||||
From interface
org.springframework.security.web.firewall.HttpFirewall
|
Provides the request object which will be passed through the filter chain.
RequestRejectedException |
---|
Provides the response which will be passed through the filter chain.
response | the original response |
---|