X

Technology insights, news and tips.

  • Sun
    May 4, 2009

Servlet 3.0 Security Annotations

Update: The security annotations have been changed. The updated information can be found in my blog, Follow up on Servlet 3.0 Security Annotations.

In Servlet 2.5, only @DeclareRoles and @RunAs are supported in servlets.
And @DenyAll, @PermitAll, @RolesAllowed are only supported for EJBs.
In JSR 315: Java Servlet 3.0 Specification,
@DenyAll, @PermitAll, @RolesAllowed will be supported in servlets.
Furthermore, it supports
JSR 250: Common Annotations for the Java Platform MR1:

  • @TransportProtected, a new annotation indicates whether the transport is confidential or none.
  • @DenyAll will also be available at the TYPE level.

The mapping of the @DenyAll, @PermitAll, @RolesAllowed and @TransportProtected to
security constraint are described in Chapter 13.4.1 of
Servlet 3.0 specification.
These annotations can be applied to:

  • the servlet class
  • one of the following methods in HttpServlet:
    • doDelete
    • doGet
    • doHead
    • doOptions
    • doPost
    • doPut
    • doTrace

Note that method level authorization annotations (@DenyAll, @PermitAll, @RolesAllowed)
override those in class level for the associated http method.
Similarly, method level @TransportProtected overrides the one in class level.

In this blog, we illustrate the usages of these annotations by examples.

Example 1: Type Level

@WebServlet("/myurl")

@RolesAllowed("javaee")

public class TestServlet extends HttpServlet {

    ...

}

In this case, all http methods are protected and accessible only by users with role javaee.

Example 2: Method Level

@WebServlet("/myurl")

public class TestServlet extends HttpServlet {

    @PermitAll

    protected void doGet(HttpServletRequest req, HttpServletResponse res)

            throws IOException, ServletException {

        ...

    }



    @RolesAllowed("javaee")

    protected void doPost(HttpServletRequest req, HttpServletResponse res)

            throws IOException, ServletException {

        ...

    }



    @DenyAll

    protected void doTrace(HttpServletRequest req, HttpServletResponse res)

            throws IOException, ServletException {

        ...

    }

}

The behaviors of the above servlet can be summarized as follows:

Http methodBehavior
GETall can access GET method
POSTonly authenticated users with role javaee can access POST method
TRACEno one can access TRACE method

Example 3: Type and Method Level

@WebServlet("/myurl")

@RolesAllowed("javaee")

public class TestServlet extends HttpServlet {

    ...



    @RolesAllowed("staff")

    protected void doPost(HttpServletRequest req, HttpServletResponse res)

            throws IOException, ServletException {

        ...

    }



    @PermitAll

    protected void doTrace(HttpServletRequest req, HttpServletResponse res)

            throws IOException, ServletException {

        ...

    }

}

The behaviors of the above servlet can be summarized as follows:

Http methodBehavior
POSTonly authenticated users with role staff can access POST method
TRACEall can access TRACE method
methods other than POST and TRACEonly authenticated users with role javaee can access

Example 4: @TransportProtected and @RolesAllowed

@WebServlet("/myurl")

@TransportProtected

public class TestServlet extends HttpServlet {

    ...



    @TransportProtected(false)

    @RolesAllowed("javaee")

    protected void doTrace(HttpServletRequest req, HttpServletResponse res)

        throws IOException, ServletException {



        ...

    }

}

The behaviors of the above servlet can be summarized as follows:

Http methodBehavior
TRACEno https, only authenticated users with role javaee can access TRACE method
methods other than TRACErequire https

Join the discussion

Comments ( 4 )
  • Rajiv Mordani's Blog Friday, May 8, 2009
    [Trackback] The proposed final draft of the Servlet 3.0 specification is now available at the JCP site . In addition to the specification, also refer to Shing Wai's blog describing in detail the ordering solution for fragments and the use of...
  • Arun Gupta's Blog Tuesday, May 19, 2009
    [Trackback] EJB 3.1 (JSR 318) and Servlet 3.0 (JSR 315) are the two new JSRs in Java EE 6 (JSR 316). The EJB 3.1 specification provides multiple new features such as WAR packaging, Optional Local Business Interfaces, EJB.lite, Portable Global...
  • Arun Gupta's Blog Wednesday, May 20, 2009
    [Trackback] EJB 3.1 (JSR 318) and Servlet 3.0 (JSR 315) are the two new JSRs in Java EE 6 (JSR 316). The EJB 3.1 specification provides multiple new features such as WAR packaging, Optional Local Business Interfaces, EJB.lite, Portable Global...
  • Shing Wai Chan Thursday, October 29, 2009

    Since May 2009, Servlet 3.0 Security Annotations have been changed a lot. I have another blog, "Follow up on Servlet Security 3.0 Annotations", http://blogs.sun.com/swchan/entry/follow_up_on_servlet_3 .


Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.