org.apache.wicket.protocol.https
Class HttpsRequestCycleProcessor

java.lang.Object
  org.apache.wicket.request.AbstractRequestCycleProcessor
      org.apache.wicket.protocol.http.WebRequestCycleProcessor
          org.apache.wicket.protocol.https.HttpsRequestCycleProcessor

All Implemented Interfaces:

IRequestCycleProcessor

public class HttpsRequestCycleProcessor
extends WebRequestCycleProcessor

Request cycle processor that can switch between http and https protocols based on the RequireHttps annotation. Once this processor is installed, any page annotated with the RequireHttps annotation will be served over https, while any page lacking the annotation will be served over http. The annotation can be placed on a super class or an interface that a page implements. To install this processor:

 class MyApplication extends WebApplication
 {
        @Override
        protected IRequestCycleProcessor newRequestCycleProcessor()
        {
                return new HttpsRequestCycleProcessor(config);
        }
 }
 

Notes: According to servlet spec a cookie created on an https request is marked as secure, such cookies are not available for http requests. What this means is that a session started over https will not be propagated to further http calls because JSESSIONID cookie will be marked as secure and not available to http requests. This entails that unless a session is created and bound on http prior to using an https request any wicket pages or session values stored in the https session will not be available to further http requests. If your application requires a http->https->http interactions (such as the case where only a login page and my account pages are secure) you must make sure a session is created and stored in the http request prior to the first http->https redirect.

Constructor Summary

HttpsRequestCycleProcessor(HttpsConfig httpsConfig)
Constructor

Method Summary

protected IRequestTarget	checkSecure(IRequestTarget target) Deprecated. use checkSecureIncoming
protected IRequestTarget	checkSecureIncoming(IRequestTarget target)
protected IRequestTarget	checkSecureOutgoing(IRequestTarget target)
HttpsConfig	getConfig()
IRequestTarget	resolve(RequestCycle rc, RequestParameters rp) Resolves the request and returns the request target.
void	respond(RequestCycle requestCycle) After the target is resolved and the request events are handled, it is time to respond to the request.

Methods inherited from class org.apache.wicket.protocol.http.WebRequestCycleProcessor

newRequestCodingStrategy

Methods inherited from class org.apache.wicket.request.AbstractRequestCycleProcessor

getRequestCodingStrategy, onRuntimeException, processEvents, resolveBookmarkablePage, resolveExternalResource, resolveHomePageTarget, resolveListenerInterfaceTarget, resolveRenderedPage, resolveSharedResource, respond

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

HttpsRequestCycleProcessor

public HttpsRequestCycleProcessor(HttpsConfig httpsConfig)

Constructor

Parameters:

httpsConfig - configuration

Method Detail

getConfig

public HttpsConfig getConfig()

Returns:

configuration

checkSecure

@Deprecated
protected IRequestTarget checkSecure(IRequestTarget target)

Deprecated. use checkSecureIncoming

checkSecureIncoming

protected IRequestTarget checkSecureIncoming(IRequestTarget target)

checkSecureOutgoing

protected IRequestTarget checkSecureOutgoing(IRequestTarget target)

resolve

public IRequestTarget resolve(RequestCycle rc,
                              RequestParameters rp)

Resolves the request and returns the request target. Typically, the resolver uses the RequestParameters object that is passed in.

Implementors of this method should be careful not to mix this code with event handling code; method IRequestCycleProcessor.processEvents(RequestCycle) is meant for that purpose.

Specified by:

resolve in interface IRequestCycleProcessor

Overrides:

resolve in class WebRequestCycleProcessor

Parameters:

rc - the current request cycle

rp - The request parameters object as decoded by this processor's IRequestCodingStrategy.

Returns:

the request target; has to be non-null!

See Also:

IRequestCycleProcessor.resolve(org.apache.wicket.RequestCycle, org.apache.wicket.request.RequestParameters)

respond

public void respond(RequestCycle requestCycle)

After the target is resolved and the request events are handled, it is time to respond to the request. This method is responsible for executing the proper response sequence given the current request target and response.

Specified by:

respond in interface IRequestCycleProcessor

Overrides:

respond in class AbstractRequestCycleProcessor

Parameters:

requestCycle - the current request cycle

See Also:

IRequestCycleProcessor.respond(org.apache.wicket.RequestCycle)