javalin-security-opaque-token/io.github.mzlnk.javalin.security.opaquetoken/OpaqueTokenConfig

OpaqueTokenConfig

Configuration for the opaqueToken strategy factory.

lookup is required. The identity type your OpaqueTokenLookup returns is your own — bring your own type; roles come from OpaqueTokenDetails.roles. Builds an OpaqueTokenAuthenticator, and selects a BearerChallengeUnauthorizedHandler when bearerChallenge is true.

Properties

bearerChallenge

@JvmField

var bearerChallenge: Boolean

When true, failed or absent authentication includes a WWW-Authenticate: Bearer header with the 401 response (via BearerChallengeUnauthorizedHandler).

clock

@JvmField

var clock: Clock

Clock used for OpaqueTokenDetails.expiresAt validation. Defaults to Clock.systemUTC.

forbiddenHandler

@JvmField

var forbiddenHandler: ForbiddenHandler

Renders 403 responses for authenticated callers denied by authorization. Defaults to a bare 403.

lookup

@JvmField

var lookup: OpaqueTokenLookup?

Resolves a raw opaque token to its stored OpaqueTokenDetails. Required; throws SecurityConfigurationException if unset when the strategy is built.

realm

@JvmField

var realm: String

Realm attribute included in the WWW-Authenticate header when bearerChallenge is true.

resolver

@JvmField

var resolver: TokenResolver

Locates the raw token in the request. Defaults to TokenResolver.DEFAULT (Authorization: Bearer ...).

unauthorizedHandler

@JvmField

var unauthorizedHandler: UnauthorizedHandler

Renders 401 responses for failed or absent authentication. Defaults to UnauthorizedHandler.DEFAULT (bare HTTP 401). Ignored when bearerChallenge is true.