public Class UndertowOptions

The AJP protocol itself supports the passing of arbitrary request attributes. The reverse proxy passes various information to the AJP connector using request attributes through AJP protocol. Unrecognised request attributes will be ignored unless the entire attribute name matches this regular expression. If not specified, the default value is null.

If a request comes in with encoded / characters (i.e. %2F), will these be decoded.

This can cause security problems if a front end proxy does not perform the same decoding, and as a result this is disabled by default.

Defaults to false

See CVE-2007-0450

See Also

DECODE_SLASH

If this is true then Undertow will allow non-escaped equals characters in unquoted cookie values.

Unquoted cookie values may not contain equals characters. If present the value ends before the equals sign. The remainder of the cookie value will be dropped.

default is false

If unknown protocols should be allowed. The known protocols are: HTTP/0.9 HTTP/1.0 HTTP/1.1 HTTP/2.0 If this is false then requests that specify any other protocol will be rejected with a 400 Defaults to false

If this is true then a Date header will be added to all responses. The HTTP spec says this header should be added to all responses, unless the server does not have an accurate clock.

Defaults to true

If this is true then a Connection: keep-alive header will be added to responses, even when it is not strictly required by the specification.

Defaults to true

If we should buffer pipelined requests. Defaults to false.

If a request comes in with encoded / characters (i.e. %2F), will these be decoded.

This can cause security problems if a front end proxy does not perform the same decoding, and as a result this is disabled by default.

If this option is set explicitly, the ALLOW_ENCODED_SLASH is ignored. Should default to true

See CVE-2007-0450

If this is true then the parser will decode the URL and query parameters using the selected character encoding (UTF-8 by default). If this is false they will not be decoded. This will allow a later handler to decode them into whatever charset is desired.

Defaults to true.

We do not have a default upload limit

The default size we allow for the HTTP header.

Default value of MAX_RST_FRAMES_PER_WINDOW option.

The default read timeout to be used by read operations that absolutely require a timeout. Used only when both READ_TIMEOUT and IDLE_TIMEOUT are not used.

Default value of RST_FRAMES_TIME_WINDOW option.

If connector level statistics should be enabled. This has a slight performance impact, but allows statistics such as bytes sent/recevied to be monitored.

If we should attempt to use HTTP2 for HTTPS connections.

If this is true then Undertow will enable RFC6265 compliant cookie validation for Set-Cookie header instead of legacy backward compatible behavior. default is false

If we should attempt to use SPDY for HTTPS connections. SPDY is no longer supported, use HTTP/2 instead

If connector level statistics should be enabled. This has a slight performance impact, but allows statistics such as bytes sent/recevied to be monitored. If this is passed to the client then client statistics will be enabled.

The endpoint identification algorithm, the empty string can be used to set none.

See Also

javax.net.ssl.SSLParameters#setEndpointIdentificationAlgorithm(String)

Undertow keeps a LRU cache of common huffman encodings. This sets the maximum size, setting this to 0 will disable the caching.

The maximum amount of padding to send in a HTTP/2 frame. Actual amount will be randomly determined, defaults to Zero.

If push should be enabled for this connection.

The size of the header table that is used in the encoder

The maximum number of concurrent http2 streams.

Deprecated, as it is effectively a duplicate of MAX_HEADER_SIZE

The maximum number of headers that are cached per connection. Defaults to 15. If this is set to zero the cache is disabled.

The idle timeout in milliseconds after which the channel will be closed. If the underlying channel already has a read or write timeout set the smaller of the two values will be used for read/write timeouts.

The maximum AJP packet size, default is 8192

Maximum size of a buffered request, in bytes

Requests are not usually buffered, the most common case is when performing SSL renegotiation for a POST request, and the post data must be fully buffered in order to perform the renegotiation.

Defaults to 16384.

The maximum size of a header name+value combo that is cached in the per connection cache. Defaults to 150

The maximum number of concurrent requests that will be processed at a time. This differs from max concurrent streams in that it is not sent to the remote client. If the number of pending requests exceeds this number then requests will be queued, the difference between this and max concurrent streams determines the maximum number of requests that will be queued. Queued requests are processed by a priority queue, rather than a FIFO based queue, using HTTP2 stream priority. If this number is smaller than or equal to zero then max concurrent streams determines the maximum number of streams that can be run.

The maximum number of cookies that will be parsed. This is used to protect against hash vulnerabilities.

Defaults to 200

The default maximum size of the HTTP entity body.

The maximum size in bytes of a http request header.

The maximum number of headers that will be parsed. This is used to protect against hash vulnerabilities.

Defaults to 200

The maximum number of parameters that will be parsed. This is used to protect against hash vulnerabilities.

This applies to both query parameters, and to POST data, but is not cumulative (i.e. you can potentially have max parameters * 2 total parameters).

Defaults to 1000

The maximum number of buffers that will be used before reads are paused in framed protocols. Defaults to 10

Maximum number of HTTP2 RST frames received allowed during a time window. If a number of RST frames bigger than this limit is received during RST_FRAMES_TIME_WINDOW milliseconds, the server will send a GO_AWAY frame with error code 11 (ENHANCE_YOUR_CALM) and it will close the connection.

The default maximum size of the HTTP entity body when using the mutiltipart parser. Generall this will be larger than MAX_ENTITY_SIZE. If this is not specified it will be the same as MAX_ENTITY_SIZE.

The amount of time the connection can be idle with no current requests before it is closed;

The maximum numbers of frames that can be queued before reads are suspended. Once this number is hit then reads will not be resumed until QUEUED_FRAMES_LOW_WATER_MARK is hit. Defaults to 50

The point at which reads will resume again after hitting the high water mark Defaults to 10

If this is true then Undertow will record the request start time, to allow for request time to be logged This has a small but measurable performance impact default is false

The maximum allowed time of reading HTTP request in milliseconds. -1 or missing value disables this functionality.

If this is true then HTTP/1.1 requests will be failed if no host header is present.

Window of time per which the number of HTTP2 RST received frames is measured, in milliseconds. If a number of RST frames bigger than MAX_RST_FRAMES_PER_WINDOW is received during this time window, the server will send a GO_AWAY frame with error code 11 (ENHANCE_YOUR_CALM) and it will close the connection.

The server shutdown timeout in milliseconds after which the executor will be forcefully shut down interrupting tasks which are still executing. There is no timeout by default.

This option forces io.undertow.protocols.ssl.UndertowXnioSsl to use a specific name as the javax.net.ssl.SNIHostName for a client connection. If the option is not set, the URL hostname is used when available (for URLs that do not use the IP address). The option can be useful when connecting via IP but want to set a SNI hostname value.

If the SSLEngine should prefer the servers cipher version. Only applicable on JDK8+.

If active request tracking should be enabled. This has a slight performance impact, and will only be honored if ENABLE_STATISTICS is also enabled.

If this is true then the parser will decode the URL and query parameters using the selected character encoding (UTF-8 by default). If this is false they will not be decoded. This will allow a later handler to decode them into whatever charset is desired.

Defaults to true.