Package jakarta.servlet.annotation

Annotation Type HttpMethodConstraint

@Retention(RUNTIME)
@Documented
public @interface HttpMethodConstraint

Specific security constraints can be applied to different types of request, differentiated by the HTTP protocol method type by using this annotation inside the ServletSecurity annotation.

Since:

Servlet 3.0

Required Element Summary

Required Elements

Modifier and Type	Required Element	Description
String	value	HTTP Protocol method name (e.g.

Optional Element Summary

Optional Elements

Modifier and Type	Optional Element	Description
ServletSecurity.EmptyRoleSemantic	emptyRoleSemantic	The EmptyRoleSemantic determines the behaviour when the rolesAllowed list is empty.
String[]	rolesAllowed	The authorized roles' names.
ServletSecurity.TransportGuarantee	transportGuarantee	Determines whether SSL/TLS is required to process the current request.

Element Details

value

String value

HTTP Protocol method name (e.g. POST, PUT)

Returns:

method name

emptyRoleSemantic

ServletSecurity.EmptyRoleSemantic emptyRoleSemantic

The EmptyRoleSemantic determines the behaviour when the rolesAllowed list is empty.

Returns:

empty role semantic

Default:

PERMIT

transportGuarantee

ServletSecurity.TransportGuarantee transportGuarantee

Determines whether SSL/TLS is required to process the current request.

Returns:

transport guarantee

Default:

NONE

rolesAllowed

String[] rolesAllowed

The authorized roles' names. The container may discard duplicate role names during processing of the annotation. N.B. The String "*" does not have a special meaning if it occurs as a role name.

Returns:

array of names. The array may be of zero length, in which case the EmptyRoleSemantic applies; the returned value determines whether access is to be permitted or denied regardless of the identity and authentication state in either case, PERMIT or DENY.
Otherwise, when the array contains one or more role names access is permitted if the user a member of at least one of the named roles. The EmptyRoleSemantic is not applied in this case.

Default:

{}