disable Jersey generation WADL for OPTIONS request
* WADL exposes available method names on Jersey classes, which can be a
security concern
* This feature also does not currently work with Java > 8 since we don't
provide a JAXB runtime implementation.
package io.confluent.rest;
-import static io.confluent.rest.RestConfig.REST_SERVLET_INITIALIZERS_CLASSES_CONFIG;
-import static io.confluent.rest.RestConfig.WEBSOCKET_SERVLET_INITIALIZERS_CLASSES_CONFIG;
-
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.jaxrs.base.JsonParseExceptionMapper;
-import java.util.function.Consumer;
import org.eclipse.jetty.jaas.JAASLoginService;
import org.eclipse.jetty.jmx.MBeanContainer;
import org.eclipse.jetty.security.ConstraintMapping;
@@ -69,6 +65,7 @@ import java.util.List;
import java.util.Map;
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.TimeUnit;
+import java.util.function.Consumer;
import javax.servlet.DispatcherType;
import javax.servlet.ServletException;
@@ -85,6 +82,9 @@ import io.confluent.rest.exceptions.WebApplicationExceptionMapper;
import io.confluent.rest.metrics.MetricsResourceMethodApplicationListener;
import io.confluent.rest.validation.JacksonMessageBodyProvider;
+import static io.confluent.rest.RestConfig.REST_SERVLET_INITIALIZERS_CLASSES_CONFIG;
+import static io.confluent.rest.RestConfig.WEBSOCKET_SERVLET_INITIALIZERS_CLASSES_CONFIG;
+
/**
* A REST application. Extend this class and implement setupResources() to register REST
* resources with the JAX-RS server. Use createServer() to get a fully-configured, ready to run
@@ -540,6 +540,7 @@ public abstract class Application<T extends RestConfig> {
metricTags, restConfig.getTime()));
config.property(ServerProperties.BV_SEND_ERROR_IN_RESPONSE, true);
+ config.property(ServerProperties.WADL_FEATURE_DISABLE, true);
}
/**
