net.sf.mmm.service.base.server

Interface RemoteInvocationSecurityDetector

All Known Implementing Classes:

RemoteInvocationSecurityDetectorImpl

@ComponentSpecification
public interface RemoteInvocationSecurityDetector

This is the interface for a detector that can decide if a RemoteInvocationCall is secured or a login operation.

Since:

1.0.0

Author:

Joerg Hohwiller (hohwille at users.sourceforge.net)

See Also:

CsrfTokenManager.generateInitialToken()

Field Summary

Fields

Modifier and Type	Field and Description
static String	LOGIN_COMMAND_NAME The name of RemoteInvocationCommand representing a login operation.
static String	LOGIN_METHOD_NAME The name of RemoteInvocationService Method representing a login operation.

Method Summary

Modifier and Type	Method and Description
boolean	isLogin(AnnotatedElement operation) Determines if a RemoteInvocationCall represents the login operation.
boolean	isSecured(AnnotatedElement operation) Determines if a RemoteInvocationCall is secured.

Field Detail

LOGIN_METHOD_NAME

static final String LOGIN_METHOD_NAME

The name of RemoteInvocationService Method representing a login operation.

See Also:

Constant Field Values

LOGIN_COMMAND_NAME

static final String LOGIN_COMMAND_NAME

The name of RemoteInvocationCommand representing a login operation.

See Also:

Constant Field Values

Method Detail

isSecured

boolean isSecured(AnnotatedElement operation)

Determines if a RemoteInvocationCall is secured. Here secured means that it can not be invoked before the login operation has been invoked and a CsrfToken has been generated.
A typical implementation shall honor common standards such as JSR 250 so RemoteInvocationCall will be considered as secured if annotated with security.RolesAllowed and will not be secured if annotated with security.PermitAll.

Parameters:

operation - is the AnnotatedElement to check. In case of a RemoteInvocationCommand this will be the command class, in case of a RemoteInvocationService operation this will be the Method.

Returns:

true if secured, false otherwise (no security required).

isLogin

boolean isLogin(AnnotatedElement operation)

Determines if a RemoteInvocationCall represents the login operation. It is technically possible to have multiple login operations. However, for simplicity this should be avoided if possible. A regular implementation should honor the Login annotation as well as conventions such as a LOGIN_METHOD_NAME and LOGIN_COMMAND_NAME.

Parameters:

operation - is the AnnotatedElement to check. In case of a RemoteInvocationCommand this will be the command class, in case of a RemoteInvocationService operation this will be the Method.

Returns:

true if the given command represents the login operation, false otherwise.