Module de.cuioss.http
Package de.cuioss.http.security.config

Class SecurityConfiguration

java.lang.Object
de.cuioss.http.security.config.SecurityConfiguration
public final class SecurityConfiguration extends Object
Immutable class representing comprehensive security configuration for HTTP validation.

This class encapsulates all security policies and settings needed to configure HTTP security validators. It provides a type-safe, immutable configuration object that can be shared across multiple validation operations.

Design Principles

  • Immutability - Configuration cannot be modified once created
  • Type Safety - Strongly typed configuration parameters
  • Completeness - Covers all aspects of HTTP security validation
  • Composability - Easy to combine with builder patterns
  • Performance - Pre-processes sets for O(1) case-insensitive lookups

Configuration Categories

  • Path Security - Path traversal prevention, allowed patterns
  • Parameter Security - Query parameter validation rules
  • Header Security - HTTP header validation policies
  • Cookie Security - Cookie validation and security requirements
  • Body Security - Request/response body validation settings
  • Encoding Security - URL encoding and character validation
  • Length Limits - Size restrictions for various HTTP components
  • General Policies - Cross-cutting security concerns

Usage Examples

 // Create with builder
 SecurityConfiguration config = SecurityConfiguration.builder()
     .maxPathLength(2048)
     .allowPathTraversal(false)
     .maxParameterCount(100)
     .requireSecureCookies(true)
     .build();

 // Use in validation
 PathValidator validator = new PathValidator(config);
 validator.validate("/api/users/123");

 // Create restrictive configuration
 SecurityConfiguration strict = SecurityConfiguration.strict();

 // Create permissive configuration
 SecurityConfiguration lenient = SecurityConfiguration.lenient();
Implements: Task C1 from HTTP verification specification
Since:
1.0
See Also: