HTTPS and RESTEasy

Is there a wa开发者_JAVA技巧y within the RESTEasy configuration (using 2.*) or jax-rs to not allow http access to any REST based web services? I want to only serve the web service end points under https.

In tomcat its done in on a per port basis. There looks to be 3 steps to setting this up.

1) Creating the KeyStore file. I used java to gen this command is as follows

Keytool –genkey –alias presto  –keypass prestoAdmin  –keystore presto.bin –storepass prestoAdmin

Copy the presto.bin file into the webapps dir of tomcat

2) Setting up server.xml for tomcat

<Connector port=”PORT_TO_BE_SCURED”  maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile../webapps/presto.bin " keystorePass="prestoAdmin"
clientAuth="false" sslProtocol="TLS"/>

3) Configuring the web service to use the secured connection. Add the following to web.xml

<security-constraint>
<web-resource-collection>
<web-resource-name>securedapp</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

I pulled this from http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html

Here's how I did this:

HttpServletRequest httpServletRequest =
    ResteasyProviderFactory.getContextData(HttpServletRequest.class);
HttpServletResponse httpServletResponse =
    ResteasyProviderFactory.getContextData(HttpServletResponse.class);

if (!httpServletRequest.isSecure())
{
    try
    {
        httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Use HTTPS");
    }
    catch (IOException e)
    {
        throw new WebApplicationException(e);
    }
}

This is pure-RESTEasy solution and you can place this code anywhere before handling request.

I used tapestry-resteasy integration and implemented this using tapestry service advisors.

I believe that this configuration should not be at RESTEasy side, but rather at servlet container or web server.

For example if you run Tomcat, in server.xml remove connector from 8080 port and define one for 8443 port. So Tomcat won't accept the http traffic anymore.