Package org.exoplatform.caldav.rest

Class CaldavHttpFirewallConfiguration

java.lang.Object
org.exoplatform.caldav.rest.CaldavHttpFirewallConfiguration
@Configuration public class CaldavHttpFirewallConfiguration extends Object
Admits the DAV verbs through this webapp's Spring Security firewall. StrictHttpFirewall — the default of the FilterChainProxy every request crosses before reaching the dispatcher — only allows the seven standard HTTP methods, so PROPFIND, REPORT and MKCALENDAR were rejected as 400 (a Tomcat error page) before the relay controller ever existed to the request. Verified live: FOOBAR and PROPFIND on the relay path answered the same 400, while GET reached the security chain.

The allowed-method list is built as standard-HTTP ∪ CaldavRelayService.ALLOWED_METHODS — the same constant the relay's own 405 gate reads — never as setUnsafeAllowAnyHttpMethod(true). The two gates therefore cannot diverge in the dangerous direction: a verb added to the relay's list is automatically admitted here, and a verb only the firewall admits (the standard ones the registry admin REST needs) still meets the relay's 405 on the relay path. Every other StrictHttpFirewall default is kept: the hrefs the validated servers advertise pass them (BlueMind's calendar:Default:<uid> colons and Stalwart's %40 are legal), and what they refuse — encoded slashes, semicolons, backslashes, dot-segments — is exactly what the relay's own path validation refuses too.

The customizer is a org.springframework.security.config.annotation.web.configuration .WebSecurityCustomizer (Spring Security's, not the same-named Meeds interface, which customizes HttpSecurity): the platform's @EnableWebSecurity configuration collects those beans and applies them to this WAR's WebSecurity — the object holding the firewall. Scoped to the caldav Spring context, so no other webapp's firewall changes.

  • Constructor Details

    • CaldavHttpFirewallConfiguration

      public CaldavHttpFirewallConfiguration()

  • Method Details

    • caldavHttpFirewallCustomizer

      @Bean public org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer caldavHttpFirewallCustomizer()
      The customizer installing the DAV-aware firewall on this webapp's security filter chain.
      Returns:
      the customizer Spring Security's configuration collects

    • davAwareHttpFirewall

      public static org.springframework.security.web.firewall.StrictHttpFirewall davAwareHttpFirewall()
      The firewall itself: strict defaults, methods widened to standard-HTTP plus the relay's own allow-list. Static and public so the test can pin the exact instance the webapp runs, not a reconstruction of it.
      Returns:
      the firewall admitting the DAV verbs