HttpMethodConstraint (Servlet {servlet.spec.version} API Documentation - Apache Tomcat 8.5.78)

Package javax.servlet.annotation

## Annotation Type HttpMethodConstraint

-     @Retention(RUNTIME)
      @Documented
      public @interface HttpMethodConstraint

  Specific security constraints can be applied to different types of request, differentiated by the HTTP protocol method type by using this annotation inside the `ServletSecurity` annotation.
  Since:
    Servlet 3.0

- - ### Required Element Summary

    Required Elements
    Modifier and Type | Required Element | Description
    --- | --- | ---
    `java.lang.String` | `value` | HTTP Protocol method name (e.g.

  - ### Optional Element Summary

    Optional Elements
    Modifier and Type | Optional Element | Description
    --- | --- | ---
    `ServletSecurity.EmptyRoleSemantic` | `emptyRoleSemantic` | The EmptyRoleSemantic determines the behaviour when the rolesAllowed list is empty.
    `java.lang.String[]` | `rolesAllowed` | The authorized roles' names.
    `ServletSecurity.TransportGuarantee` | `transportGuarantee` | Determines whether SSL/TLS is required to process the current request.

- - ### Element Detail

    - #### value

          java.lang.String value

      HTTP Protocol method name (e.g. POST, PUT)
      Returns:
        method name

  - - #### emptyRoleSemantic

          ServletSecurity.EmptyRoleSemantic emptyRoleSemantic

      The EmptyRoleSemantic determines the behaviour when the rolesAllowed list is empty.
      Returns:
        empty role semantic
      Default:
        javax.servlet.annotation.ServletSecurity.EmptyRoleSemantic.PERMIT

  - - #### transportGuarantee

          ServletSecurity.TransportGuarantee transportGuarantee

      Determines whether SSL/TLS is required to process the current request.
      Returns:
        transport guarantee
      Default:
        javax.servlet.annotation.ServletSecurity.TransportGuarantee.NONE

  - - #### rolesAllowed

          java.lang.String[] rolesAllowed

      The authorized roles' names. The container may discard duplicate role names during processing of the annotation. N.B. The String "*" does not have a special meaning if it occurs as a role name.
      Returns:
        array of names. The array may be of zero length, in which case the EmptyRoleSemantic applies; the returned value determines whether access is to be permitted or denied regardless of the identity and authentication state in either case, PERMIT or DENY.
        Otherwise, when the array contains one or more role names access is permitted if the user a member of at least one of the named roles. The EmptyRoleSemantic is not applied in this case.
      Default:
        {}