X-Git-Url: https://gerrit.akraino.org/r/gitweb?p=validation.git;a=blobdiff_plain;f=ui%2Fsrc%2Fmain%2Fwebapp%2FWEB-INF%2Fweb.xml;fp=ui%2Fsrc%2Fmain%2Fwebapp%2FWEB-INF%2Fweb.xml;h=6fd8b998e3d347a04e8979f618faaec46092585d;hp=20716323530519f8a23d539fbb0642521e166986;hb=f0359240d6f093f08eca0a077a37ab3b5b842765;hpb=5209bb26e2b70f6eefbccf61713dc2633751b86b

diff --git a/ui/src/main/webapp/WEB-INF/web.xml b/ui/src/main/webapp/WEB-INF/web.xml
index 2071632..6fd8b99 100644
--- a/ui/src/main/webapp/WEB-INF/web.xml
+++ b/ui/src/main/webapp/WEB-INF/web.xml
@@ -45,4 +45,26 @@
         <location>/WEB-INF/jsp/error.jsp</location>
     </error-page>
 
+     <!-- Require HTTPS for everything except /img (favicon) and /css. -->
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>HTTPSOnly</web-resource-name>
+            <url-pattern>/*</url-pattern>
+        </web-resource-collection>
+        <user-data-constraint>
+            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+        </user-data-constraint>
+    </security-constraint>
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>HTTPSOrHTTP</web-resource-name>
+            <url-pattern>*.ico</url-pattern>
+            <url-pattern>/img/*</url-pattern>
+            <url-pattern>/css/*</url-pattern>
+        </web-resource-collection>
+        <user-data-constraint>
+            <transport-guarantee>NONE</transport-guarantee>
+        </user-data-constraint>
+    </security-constraint>
+
 </web-app>
\ No newline at end of file