001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *   http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied.  See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019package org.eclipse.aether.transport.jetty;
020
021import org.eclipse.aether.ConfigurationProperties;
022import org.eclipse.aether.RepositorySystemSession;
023
024/**
025 * Configuration for Jetty Transport.
026 *
027 * @since 2.0.1
028 */
029public final class JettyTransporterConfigurationKeys {
030    private JettyTransporterConfigurationKeys() {}
031
032    static final String CONFIG_PROPS_PREFIX =
033            ConfigurationProperties.PREFIX_TRANSPORT + JettyTransporterFactory.NAME + ".";
034
035    /**
036     * If enabled, Jetty client will follow HTTP redirects.
037     *
038     * @configurationSource {@link RepositorySystemSession#getConfigProperties()}
039     * @configurationType {@link Boolean}
040     * @configurationDefaultValue {@link #DEFAULT_FOLLOW_REDIRECTS}
041     * @configurationRepoIdSuffix Yes
042     * @deprecated Use {@link ConfigurationProperties#HTTP_REDIRECT_MODE} instead.
043     */
044    @Deprecated
045    public static final String CONFIG_PROP_FOLLOW_REDIRECTS = CONFIG_PROPS_PREFIX + "followRedirects";
046
047    public static final boolean DEFAULT_FOLLOW_REDIRECTS = true;
048
049    /**
050     * The max redirect count to follow.
051     *
052     * @configurationSource {@link RepositorySystemSession#getConfigProperties()}
053     * @configurationType {@link Integer}
054     * @configurationDefaultValue {@link #DEFAULT_MAX_REDIRECTS}
055     * @configurationRepoIdSuffix Yes
056     */
057    public static final String CONFIG_PROP_MAX_REDIRECTS = CONFIG_PROPS_PREFIX + "maxRedirects";
058
059    public static final int DEFAULT_MAX_REDIRECTS = 5;
060
061    /**
062     * If enabled, Jetty client will follow redirects that downgrade the protocol from https to http. Disabled by
063     * default: such a downgrade strips transport encryption from artifact and checksum bytes and makes repository
064     * credentials eligible for transmission over plaintext, so a downgrading redirect fails the transfer instead.
065     *
066     * @configurationSource {@link RepositorySystemSession#getConfigProperties()}
067     * @configurationType {@link Boolean}
068     * @configurationDefaultValue {@link #DEFAULT_FOLLOW_INSECURE_REDIRECTS}
069     * @configurationRepoIdSuffix Yes
070     * @since 2.0.23
071     * @deprecated Use {@link ConfigurationProperties#HTTP_FOLLOW_INSECURE_REDIRECT} instead.
072     */
073    @Deprecated
074    public static final String CONFIG_PROP_FOLLOW_INSECURE_REDIRECTS = CONFIG_PROPS_PREFIX + "followInsecureRedirects";
075
076    /** @deprecated Use {@link ConfigurationProperties#DEFAULT_HTTP_FOLLOW_INSECURE_REDIRECT} instead. */
077    @Deprecated
078    public static final boolean DEFAULT_FOLLOW_INSECURE_REDIRECTS = false;
079
080    /**
081     * If enabled (default), operator-configured request headers ({@code aether.transport.http.headers}) and
082     * preemptively applied {@code Authorization} are only sent on requests targeting the repository origin (the
083     * scheme, host and port the repository URL denotes). Jetty's redirector copies the request headers onto every
084     * redirect hop it follows, so without origin scoping a cross-origin redirect replays the configured headers -
085     * which frequently carry credentials such as {@code Authorization} or private token headers - to the redirect
086     * target host. Disable only when a redirect target legitimately requires the configured headers.
087     *
088     * @configurationSource {@link RepositorySystemSession#getConfigProperties()}
089     * @configurationType {@link Boolean}
090     * @configurationDefaultValue {@link #DEFAULT_ORIGIN_SCOPED_HEADERS}
091     * @configurationRepoIdSuffix Yes
092     * @since 2.0.23
093     * @deprecated Use {@link ConfigurationProperties#HTTP_ORIGIN_SCOPED_HEADERS} instead.
094     */
095    @Deprecated
096    public static final String CONFIG_PROP_ORIGIN_SCOPED_HEADERS = CONFIG_PROPS_PREFIX + "originScopedHeaders";
097
098    /** @deprecated Use {@link ConfigurationProperties#DEFAULT_HTTP_ORIGIN_SCOPED_HEADERS} instead. */
099    @Deprecated
100    public static final boolean DEFAULT_ORIGIN_SCOPED_HEADERS = true;
101}