HTTPS and RESTEasy - jax-rs

Question

Is there a way within the RESTEasy configuration (using 2.*) or jax-rs to not allow http access to any REST based web services? I want to only serve the web service end points under https.

Answer 1

In tomcat its done in on a per port basis. There looks to be 3 steps to setting this up.
1) Creating the KeyStore file. I used java to gen this command is as follows
Keytool –genkey –alias presto –keypass prestoAdmin –keystore presto.bin –storepass prestoAdmin
Copy the presto.bin file into the webapps dir of tomcat
2) Setting up server.xml for tomcat
<Connector port=”PORT_TO_BE_SCURED” maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile../webapps/presto.bin " keystorePass="prestoAdmin"
clientAuth="false" sslProtocol="TLS"/>
3) Configuring the web service to use the secured connection. Add the following to web.xml
<security-constraint>
<web-resource-collection>
<web-resource-name>securedapp</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
I pulled this from http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html

Answer 2

Here's how I did this:
HttpServletRequest httpServletRequest =
ResteasyProviderFactory.getContextData(HttpServletRequest.class);
HttpServletResponse httpServletResponse =
ResteasyProviderFactory.getContextData(HttpServletResponse.class);
if (!httpServletRequest.isSecure())
{
try
{
httpServletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Use HTTPS");
}
catch (IOException e)
{
throw new WebApplicationException(e);
}
}
This is pure-RESTEasy solution and you can place this code anywhere before handling request.
I used tapestry-resteasy integration and implemented this using tapestry service advisors.

Answer 3

I believe that this configuration should not be at RESTEasy side, but rather at servlet container or web server.
For example if you run Tomcat, in server.xml remove connector from 8080 port and define one for 8443 port. So Tomcat won't accept the http traffic anymore.