OSGI HttpService : securing all the servlets

Question

I'm developing servlets and register them into my OSGI container thanks to HttpService. My goal is to secure all the servlets registered in my OSGI container. I saw that I can register my Servlet with an HttpContext with my own handleSecurity method implementation to process my security.

But I'm thinking to the case where a bundle registers a servlet with the default HttpContext (with implies no security).

So my question is, is there a way to force the security of all the servlets deployed in my OSGI container once for all?

Answer 1

I'm going to use the Service hook feature (OSGI 4.3) in order to override the behaviour of HttpService.registerServlet. In my hook I'll force the usage of my HttContext implementation.

With this solution, any bundle that register a servlet with the HttpService will be secured by my HttpContext implementation.

Answer 2

The short answer is No for using the HttpService.

The longer answer, you might achieve something like this if you use the whiteboard-extender which isn't available per OSGi spec yet, but felix and pax-web do provide it. When using the whiteboard-extender you're able to register your servlet in combination with a reference to a HttpContext (as property). Of course this HttpContext would also need to be a "customized" one but you only need to register it once and are able to reference it from your Servlets. This is probably the closest you get to your question.