Class ControlPanelSecurityPaths

java.lang.Object

io.micronaut.controlpanel.core.security.ControlPanelSecurityPaths

@Internal
public final class ControlPanelSecurityPaths
extends Object

Shared route prefixes owned by the control panel itself.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	APPLICATION
static final String	APPLICATION_PATH
static final String	CACHE
static final String	CACHE_PATH
static final String	CONTROL_PANEL
static final String	CONTROL_PANEL_FILTER_PATTERN	Filter pattern for the control panel path, including the server context path.
static final String	CONTROL_PANEL_SUBPATHS_FILTER_PATTERN	Filter pattern for every route nested under CONTROL_PANEL_FILTER_PATTERN, which includes the helper controllers listed by helperPaths().
static final String	DATASOURCE
static final String	DATASOURCE_PATH
static final String	HIBERNATE
static final String	HIBERNATE_PATH
static final String	KAFKA
static final String	KAFKA_PATH
static final String	LOGGERS
static final String	LOGGERS_PATH
static final String	OBJECT_STORAGE
static final String	OBJECT_STORAGE_PATH
static final String	REQUESTED_WITH_HEADER	Name of the custom request header the control panel UI sends with its own fetch/XHR calls.
static final String	REQUESTED_WITH_VALUE	Expected value of REQUESTED_WITH_HEADER for control panel UI requests.

Method Summary

Modifier and Type	Method	Description
static List<String>	helperPaths()
static boolean	isWriteRequest(String controlPanelPath, io.micronaut.http.HttpRequest<?> request)	Determines whether a request targets a control-panel-owned write operation.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

CONTROL_PANEL

public static final String CONTROL_PANEL

See Also:

• Constant Field Values

CONTROL_PANEL_FILTER_PATTERN

public static final String CONTROL_PANEL_FILTER_PATTERN

Filter pattern for the control panel path, including the server context path. Filters using it set appendContextPath = false: the context path is part of the pattern, joined the way the router joins it, because Micronaut skips prepending it to a pattern that merely starts with the same characters (context /app, control panel path /application). The pattern is rooted with / so that a path configured without a leading slash also matches; the Ant matcher ignores the empty segments this leaves for the other configurations.

See Also:

• Constant Field Values

CONTROL_PANEL_SUBPATHS_FILTER_PATTERN

public static final String CONTROL_PANEL_SUBPATHS_FILTER_PATTERN

Filter pattern for every route nested under CONTROL_PANEL_FILTER_PATTERN, which includes the helper controllers listed by helperPaths().

See Also:

• Constant Field Values

CACHE_PATH

public static final String CACHE_PATH

See Also:

• Constant Field Values

DATASOURCE_PATH

public static final String DATASOURCE_PATH

See Also:

• Constant Field Values

HIBERNATE_PATH

public static final String HIBERNATE_PATH

See Also:

• Constant Field Values

KAFKA_PATH

public static final String KAFKA_PATH

See Also:

• Constant Field Values

LOGGERS_PATH

public static final String LOGGERS_PATH

See Also:

• Constant Field Values

OBJECT_STORAGE_PATH

public static final String OBJECT_STORAGE_PATH

See Also:

• Constant Field Values

APPLICATION_PATH

public static final String APPLICATION_PATH

See Also:

• Constant Field Values

CACHE

public static final String CACHE

See Also:

• Constant Field Values

DATASOURCE

public static final String DATASOURCE

See Also:

• Constant Field Values

HIBERNATE

public static final String HIBERNATE

See Also:

• Constant Field Values

KAFKA

public static final String KAFKA

See Also:

• Constant Field Values

LOGGERS

public static final String LOGGERS

See Also:

• Constant Field Values

OBJECT_STORAGE

public static final String OBJECT_STORAGE

See Also:

• Constant Field Values

APPLICATION

public static final String APPLICATION

See Also:

• Constant Field Values

REQUESTED_WITH_HEADER

public static final String REQUESTED_WITH_HEADER

Name of the custom request header the control panel UI sends with its own fetch/XHR calls. A cross-site form or navigation cannot set a custom header, so requiring it blocks cross-site write requests.

See Also:

• Constant Field Values

REQUESTED_WITH_VALUE

public static final String REQUESTED_WITH_VALUE

Expected value of REQUESTED_WITH_HEADER for control panel UI requests.

See Also:

• Constant Field Values

Method Details

helperPaths

public static List<String> helperPaths()

Returns:

helper route path suffixes that belong to the control panel HTTP surface

isWriteRequest

public static boolean isWriteRequest(String controlPanelPath,
 io.micronaut.http.HttpRequest<?> request)

Determines whether a request targets a control-panel-owned write operation.

Parameters:

controlPanelPath - the resolved control panel path, including any application context path

request - the HTTP request

Returns:

true if the request mutates application/runtime state