<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">
<Configure id="Server" class="org.eclipse.jetty.server.Server">

  <Ref refid="NexusWebAppContext">
    <!-- enforce use of the confidential port -->
    <Set name="securityHandler">
      <New class="org.eclipse.jetty.security.ConstraintSecurityHandler">
        <Call name="addConstraintMapping">
          <Arg>
            <New class="org.eclipse.jetty.security.ConstraintMapping">
              <Set name="pathSpec">/*</Set>
              <Set name="method">TRACE</Set>
              <Set name="constraint">
                <New class="org.eclipse.jetty.util.security.Constraint">
                  <Set name="name">Deny TRACE</Set>
                  <Set name="authenticate">true</Set>
                  <Set name="roles">
                    <Array type="String"/>
                  </Set>
                </New>
              </Set>
            </New>
          </Arg>
        </Call>
        <Call name="addConstraintMapping">
          <Arg>
            <New class="org.eclipse.jetty.security.ConstraintMapping">
              <Set name="pathSpec">/*</Set>
              <Set name="methodOmissions">
                <Array type="String">
                  <Item>TRACE</Item>
                </Array>
              </Set>
              <Set name="constraint">
                <New class="org.eclipse.jetty.util.security.Constraint">
                  <!-- 2 means CONFIDENTIAL. 1 means INTEGRITY -->
                  <Set name="dataConstraint">2</Set>
                  <Set name="name">Redirect Everything Except TRACE to HTTPS</Set>
                </New>
              </Set>
            </New>
          </Arg>
        </Call>
      </New>
    </Set>
  </Ref>

</Configure>
