如何在Servlets 3.x中以编程方式设置<security-constraint>？

Question

在我当前的Web应用程序中,我试图摆脱web.xml,但我无法正确设置强制所有对应用程序的请求使用HTTPS的安全约束.

<security-constraint>
  <web-resource-collection>
     <web-resource-name>all</web-resource-name>
     <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <user-data-constraint>
     <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

如何在servlet 3.x配置代码中执行相同操作的上述web.xml配置代码段？

UPDATE

我希望约束应用于应用程序中的每个servlet,过滤器和静态资源,到目前为止我在网上看到的示例显示将安全约束附加到servlet,但我希望将安全约束附加到Web应用程序.在上面的xml片段中,您会看到它没有引用任何特定的servlet

Answer 1

我相信你正在寻找@ServletSecurity注释

@WebServlet(urlPatterns = "/*")
@ServletSecurity(value = @HttpConstraint(transportGuarantee = TransportGuarantee.CONFIDENTIAL))
public class SomeServlet extends HttpServlet { ... } 

或者ServletRegistration在ServletContainerInitializer(或者您可以访问的任何地方ServletContext)

ServletRegistration.Dynamic dynamic = context.addServlet("someServlet", SomeServlet.class);
dynamic.addMapping("/*");
HttpConstraintElement httpConstraintElement = new HttpConstraintElement(TransportGuarantee.CONFIDENTIAL);
ServletSecurityElement servletSecurityElement = new ServletSecurityElement(httpConstraintElement);
dynamic.setServletSecurity(servletSecurityElement);