Class WebSocketServerProtocolConfig

java.lang.Object

io.netty.handler.codec.http.websocketx.WebSocketServerProtocolConfig

public final class WebSocketServerProtocolConfig
extends java.lang.Object

WebSocket server configuration.

Security note: By default no validation of the Origin header is performed during the handshake. Browsers do not apply the same-origin policy to WebSocket connections and send ambient credentials (like cookies) with the handshake request, so applications that authenticate WebSocket connections using such credentials are exposed to Cross-Site WebSocket Hijacking unless they validate the Origin header. Such applications must configure WebSocketServerProtocolConfig.Builder.allowedOrigins(String...) (or perform an equivalent check in a handler placed before WebSocketServerProtocolHandler).

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	WebSocketServerProtocolConfig.Builder

Field Summary

Fields

Modifier and Type	Field	Description
private final java.util.Set<java.lang.String>	allowedOrigins
private final boolean	checkStartsWith
private final WebSocketDecoderConfig	decoderConfig
(package private) static final long	DEFAULT_FORCE_CLOSE_TIMEOUT_MILLIS
(package private) static final long	DEFAULT_HANDSHAKE_TIMEOUT_MILLIS
private final boolean	dropPongFrames
private final long	forceCloseTimeoutMillis
private final boolean	handleCloseFrames
private final long	handshakeTimeoutMillis
private final WebSocketCloseStatus	sendCloseFrame
private final java.lang.String	subprotocols
private final java.lang.String	websocketPath

Constructor Summary

Constructors

Modifier	Constructor	Description
private	WebSocketServerProtocolConfig(java.lang.String websocketPath, java.lang.String subprotocols, boolean checkStartsWith, long handshakeTimeoutMillis, long forceCloseTimeoutMillis, boolean handleCloseFrames, WebSocketCloseStatus sendCloseFrame, boolean dropPongFrames, WebSocketDecoderConfig decoderConfig, java.util.Set<java.lang.String> allowedOrigins)

Method Summary

Modifier and Type	Method	Description
java.util.Set<java.lang.String>	allowedOrigins()	Returns the (lower-cased) origins that are allowed to open a WebSocket connection, or an empty set if the Origin header is not validated.
boolean	checkStartsWith()
WebSocketDecoderConfig	decoderConfig()
boolean	dropPongFrames()
long	forceCloseTimeoutMillis()
boolean	handleCloseFrames()
long	handshakeTimeoutMillis()
static WebSocketServerProtocolConfig.Builder	newBuilder()
WebSocketCloseStatus	sendCloseFrame()
java.lang.String	subprotocols()
WebSocketServerProtocolConfig.Builder	toBuilder()
java.lang.String	toString()
java.lang.String	websocketPath()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Details

DEFAULT_HANDSHAKE_TIMEOUT_MILLIS

static final long DEFAULT_HANDSHAKE_TIMEOUT_MILLIS

See Also:

• Constant Field Values

DEFAULT_FORCE_CLOSE_TIMEOUT_MILLIS

static final long DEFAULT_FORCE_CLOSE_TIMEOUT_MILLIS

See Also:

• Constant Field Values

websocketPath

private final java.lang.String websocketPath

subprotocols

private final java.lang.String subprotocols

checkStartsWith

private final boolean checkStartsWith

handshakeTimeoutMillis

private final long handshakeTimeoutMillis

forceCloseTimeoutMillis

private final long forceCloseTimeoutMillis

handleCloseFrames

private final boolean handleCloseFrames

sendCloseFrame

private final WebSocketCloseStatus sendCloseFrame

dropPongFrames

private final boolean dropPongFrames

decoderConfig

private final WebSocketDecoderConfig decoderConfig

allowedOrigins

private final java.util.Set<java.lang.String> allowedOrigins

Constructor Details

WebSocketServerProtocolConfig

private WebSocketServerProtocolConfig(java.lang.String websocketPath,
 java.lang.String subprotocols,
 boolean checkStartsWith,
 long handshakeTimeoutMillis,
 long forceCloseTimeoutMillis,
 boolean handleCloseFrames,
 WebSocketCloseStatus sendCloseFrame,
 boolean dropPongFrames,
 WebSocketDecoderConfig decoderConfig,
 java.util.Set<java.lang.String> allowedOrigins)

Method Details

websocketPath

public java.lang.String websocketPath()

subprotocols

public java.lang.String subprotocols()

checkStartsWith

public boolean checkStartsWith()

handshakeTimeoutMillis

public long handshakeTimeoutMillis()

forceCloseTimeoutMillis

public long forceCloseTimeoutMillis()

handleCloseFrames

public boolean handleCloseFrames()

sendCloseFrame

public WebSocketCloseStatus sendCloseFrame()

dropPongFrames

public boolean dropPongFrames()

decoderConfig

public WebSocketDecoderConfig decoderConfig()

allowedOrigins

public java.util.Set<java.lang.String> allowedOrigins()

Returns the (lower-cased) origins that are allowed to open a WebSocket connection, or an empty set if the Origin header is not validated.

toString

public java.lang.String toString()

Overrides:

toString in class java.lang.Object

toBuilder

public WebSocketServerProtocolConfig.Builder toBuilder()

newBuilder

public static WebSocketServerProtocolConfig.Builder newBuilder()