Class WebSocketServerProtocolConfig

java.lang.Object
io.netty.handler.codec.http.websocketx.WebSocketServerProtocolConfig
public final class WebSocketServerProtocolConfig extends Object
WebSocket server configuration.

Security note: By default no validation of the Origin header is performed during the handshake. Browsers do not apply the same-origin policy to WebSocket connections and send ambient credentials (like cookies) with the handshake request, so applications that authenticate WebSocket connections using such credentials are exposed to Cross-Site WebSocket Hijacking unless they validate the Origin header. Such applications must configure WebSocketServerProtocolConfig.Builder.allowedOrigins(String...) (or perform an equivalent check in a handler placed before WebSocketServerProtocolHandler).

  • Method Details

    • websocketPath

      public String websocketPath()

    • subprotocols

      public String subprotocols()

    • checkStartsWith

      public boolean checkStartsWith()

    • handshakeTimeoutMillis

      public long handshakeTimeoutMillis()

    • forceCloseTimeoutMillis

      public long forceCloseTimeoutMillis()

    • handleCloseFrames

      public boolean handleCloseFrames()

    • sendCloseFrame

      public WebSocketCloseStatus sendCloseFrame()

    • dropPongFrames

      public boolean dropPongFrames()

    • decoderConfig

      public WebSocketDecoderConfig decoderConfig()

    • allowedOrigins

      public Set<String> allowedOrigins()
      Returns the (lower-cased) origins that are allowed to open a WebSocket connection, or an empty set if the Origin header is not validated.

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • toBuilder

      public WebSocketServerProtocolConfig.Builder toBuilder()

    • newBuilder

      public static WebSocketServerProtocolConfig.Builder newBuilder()