Added CorsFilter to enable secure cross site scripting
[controller.git] / opendaylight / web / root / src / main / resources / WEB-INF / web.xml
1 <?xml version="1.0" encoding="ISO-8859-1"?>
2 <!-- <web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3         xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
4         version="2.4"> -->
5 <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
6         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
7         version="3.0">
8
9         <filter>
10           <filter-name>CorsFilter</filter-name>
11           <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
12           <init-param>
13             <param-name>cors.allowed.origins</param-name>
14             <param-value>*</param-value>
15           </init-param>
16           <init-param>
17             <param-name>cors.allowed.methods</param-name>
18             <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
19           </init-param>
20           <init-param>
21             <param-name>cors.allowed.headers</param-name>
22             <param-value>Content-Type,X-Requested-With,accept,authorization, origin,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
23           </init-param>
24           <init-param>
25             <param-name>cors.exposed.headers</param-name>
26             <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
27           </init-param>
28           <init-param>
29             <param-name>cors.support.credentials</param-name>
30             <param-value>true</param-value>
31           </init-param>
32           <init-param>
33             <param-name>cors.preflight.maxage</param-name>
34             <param-value>10</param-value>
35           </init-param>
36         </filter>
37         <filter-mapping>
38           <filter-name>CorsFilter</filter-name>
39           <url-pattern>/*</url-pattern>
40         </filter-mapping>
41
42         <security-constraint>
43           <web-resource-collection>
44              <web-resource-name>free access</web-resource-name>
45              <url-pattern>/js/*</url-pattern>
46              <url-pattern>/images/*</url-pattern>
47              <url-pattern>/css/*</url-pattern>
48              <url-pattern>/favicon.ico</url-pattern>
49           </web-resource-collection>
50         </security-constraint>
51
52         <security-constraint>
53            <display-name>RootApp</display-name>
54            <web-resource-collection>
55               <web-resource-name>RootGUI</web-resource-name>
56               <url-pattern>/*</url-pattern>
57               <http-method>POST</http-method>
58               <http-method>GET</http-method>
59               <http-method>PUT</http-method>
60               <http-method>DELETE</http-method>
61               <http-method>HEAD</http-method>
62            </web-resource-collection>
63            <auth-constraint>
64                <role-name>System-Admin</role-name>
65                <role-name>Network-Admin</role-name>
66                <role-name>Network-Operator</role-name>
67                <role-name>Container-User</role-name>
68            </auth-constraint>
69         </security-constraint>
70
71         <security-role>
72                 <role-name>System-Admin</role-name>
73         </security-role>
74         <security-role>
75                 <role-name>Network-Admin</role-name>
76         </security-role>
77         <security-role>
78                 <role-name>Network-Operator</role-name>
79         </security-role>
80         <security-role>
81                 <role-name>Container-User</role-name>
82         </security-role>
83
84
85         <login-config>
86                 <auth-method>FORM</auth-method>
87                 <form-login-config>
88                         <form-login-page>/WEB-INF/jsp/login.jsp</form-login-page>
89                         <form-error-page>/WEB-INF/jsp/error.jsp</form-error-page>
90                 </form-login-config>
91         </login-config>
92
93     <error-page>
94             <error-code>403</error-code>
95             <location>/WEB-INF/jsp/autherror.jsp</location>
96     </error-page>
97
98         <servlet>
99                 <servlet-name>RootGUI</servlet-name>
100                 <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
101                 <load-on-startup>1</load-on-startup>
102         </servlet>
103
104         <servlet-mapping>
105                 <servlet-name>RootGUI</servlet-name>
106                 <url-pattern>/</url-pattern>
107         </servlet-mapping>
108
109         <display-name>OpenDaylight Controller</display-name>
110         <description>OpenDaylight Controller</description>
111
112         <listener>
113                 <listener-class>org.opendaylight.controller.web.ControllerUISessionManager</listener-class>
114         </listener>
115
116         <session-config>
117                 <cookie-config>
118                         <path>/</path>
119                 </cookie-config>
120         </session-config>
121
122 </web-app>