Class SSLHeaderHandler

  • All Implemented Interfaces:
    HttpHandler

    public class SSLHeaderHandler
    extends java.lang.Object
    implements HttpHandler
    Handler that sets SSL information on the connection based on the following headers:

    • SSL_CLIENT_CERT
    • SSL_CIPHER
    • SSL_SESSION_ID

    If this handler is present in the chain it will always override the SSL session information, even if these headers are not present.

    This handler MUST only be used on servers that are behind a reverse proxy, where the reverse proxy has been configured to always set these header for EVERY request (or strip existing headers with these names if no SSL information is present). Otherwise it may be possible for a malicious client to spoof a SSL connection.

    Author:
    Stuart Douglas
    • Constructor Detail

      • SSLHeaderHandler

        public SSLHeaderHandler​(HttpHandler next)
    • Method Detail

      • handleRequest

        public void handleRequest​(HttpServerExchange exchange)
                           throws java.lang.Exception
        Description copied from interface: HttpHandler
        Handle the request.
        Specified by:
        handleRequest in interface HttpHandler
        Parameters:
        exchange - the HTTP request/response exchange
        Throws:
        java.lang.Exception
      • toString

        public java.lang.String toString()
        Overrides:
        toString in class java.lang.Object