You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: devtools/project-core-extension-codestarts/src/main/resources/codestarts/quarkus/extension-codestarts/lgtm-codestart/java/src/test/java/org/acme/SimpleTest.java
Copy file name to clipboardExpand all lines: docs/src/main/asciidoc/rest-client.adoc
+57-1Lines changed: 57 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1341,7 +1341,9 @@ public class TestClientRequestFilter implements ResteasyReactiveClientRequestFil
1341
1341
}
1342
1342
----
1343
1343
1344
-
== Customizing the ObjectMapper in REST Client Jackson
1344
+
== Jackson-specific features
1345
+
1346
+
=== Customizing the ObjectMapper in REST Client Jackson
1345
1347
1346
1348
The REST Client supports adding a custom ObjectMapper to be used only the Client using the annotation `@ClientObjectMapper`.
1347
1349
@@ -1369,6 +1371,60 @@ public interface ExtensionsService {
1369
1371
<2> It's must be a static method. Also, the parameter `defaultObjectMapper` will be resolved via CDI. If not found, it will throw an exception at runtime.
1370
1372
<3> In this example, we're creating a copy of the default object mapper. You should *NEVER* modify the default object mapper, but create a copy instead.
1371
1373
1374
+
=== @JsonView support
1375
+
1376
+
Jakarta REST methods can be annotated with https://fasterxml.github.io/jackson-annotations/javadoc/2.10/com/fasterxml/jackson/annotation/JsonView.html[@JsonView]
1377
+
in order to customize the serialization of the returned POJO, on a per method-basis. This is best explained with an example.
1378
+
1379
+
A typical use of `@JsonView` is to hide certain fields on certain methods. In that vein, let's define two views:
1380
+
1381
+
[source,java]
1382
+
----
1383
+
public class Views {
1384
+
1385
+
public static class Public {
1386
+
}
1387
+
1388
+
public static class Private extends Public {
1389
+
}
1390
+
}
1391
+
----
1392
+
1393
+
Let's assume we have the `User` POJO on which we want to hide some field during serialization. A simple example of this is:
1394
+
1395
+
[source,java]
1396
+
----
1397
+
public class User {
1398
+
1399
+
@JsonView(Views.Private.class)
1400
+
public int id;
1401
+
1402
+
@JsonView(Views.Public.class)
1403
+
public String name;
1404
+
}
1405
+
----
1406
+
1407
+
The REST Client supports `@JsonView` both for sending content to the REST API and for retrieving data from it:
1408
+
1409
+
[source,java]
1410
+
----
1411
+
@Path("/users")
1412
+
@RegisterRestClient
1413
+
public interface UserClient {
1414
+
@GET
1415
+
@Path("/{id}")
1416
+
@Produces(MediaType.APPLICATION_JSON)
1417
+
@JsonView(Views.Public.class)
1418
+
User get(@RestPath String id);
1419
+
1420
+
@POST
1421
+
@Consumes(MediaType.APPLICATION_JSON)
1422
+
Response create(@JsonView(Views.Public.class) User user);
1423
+
}
1424
+
----
1425
+
1426
+
In the preceding code, the `get` method would return a `User` whose `id` is always `null` while the `create` method would never include `id` in the JSON it sends to the REST API.
1427
+
1372
1428
== Exception handling
1373
1429
1374
1430
The MicroProfile REST Client specification introduces the `org.eclipse.microprofile.rest.client.ext.ResponseExceptionMapper` whose purpose is to convert an HTTP response to an exception.
Copy file name to clipboardExpand all lines: docs/src/main/asciidoc/security-cors.adoc
+8Lines changed: 8 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,6 +34,14 @@ The filter then adds CORS headers to the HTTP response, informing browsers about
34
34
For preflight requests, the filter returns an HTTP response immediately.
35
35
For regular CORS requests, the filter denies access with an HTTP 403 status if the request violates the configured policy; otherwise, the filter forwards the request to the destination if the policy allows it.
36
36
37
+
[NOTE]
38
+
====
39
+
Despite its name the CORS filter may also prevent CSRF attacks based on link:https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#using-standard-headers-to-verify-origin[Origin verification].
40
+
Therefore, since an [Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin) header is expected to be set by the browser for cross-origin JavaScript and HTML form requests, you may want to consider using it instead of the xref:security-csrf-prevention.adoc[REST CSRF filter].
41
+
42
+
You must confirm that the browser does set an `Origin` header for cross-origin requests when accessing your application, especially with HTML forms, before using the CORS filter to prevent CSRF with the link:https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#using-standard-headers-to-verify-origin[Origin verification].
43
+
====
44
+
37
45
For detailed configuration options, see the following Configuration Properties section.
0 commit comments