Expose Undertow listener configuration options #51182

mathias82 · 2025-11-22T21:19:06Z

This PR exposes several Undertow listener configuration options that were previously available in Undertow
but not exposed through Quarkus configuration.

Added configuration properties

quarkus.undertow.listener.disallowed-methods

List of HTTP methods that should be rejected with 405 Method Not Allowed
Useful for disabling unsafe methods such as TRACE or TRACK

quarkus.undertow.listener.record-request-start-time

Enables recording the request start timestamp in Undertow
Useful for logging, tracing and request timing

quarkus.undertow.listener.max-parameters

Specifies the maximum number of allowed HTTP parameters
Provides protection against parameter-based DoS attacks

Motivation

These settings improve security hardening, observability, and request handling consistency.
By exposing them as Quarkus configuration options, applications can now configure Undertow behavior
directly through application.properties like other existing Undertow-related settings.

Documentation

Documentation has been added to: docs/src/main/asciidoc/http-reference.adoc

Notes

Default values align with Undertow defaults unless overridden.
Behavior is fully backward compatible.

Fixes: Enable configuration of Undertow listener attributes (disallowed-methods, record-request-start-time, max-parameters) #51180

github-actions · 2025-11-22T23:08:27Z

🎊 PR Preview f442026 has been successfully built and deployed to https://quarkus-pr-main-51182-preview.surge.sh/version/main/guides/

Images of blog posts older than 3 months are not available.
Newsletters older than 3 months are not available.

geoand · 2025-11-23T07:00:02Z

...s/undertow/runtime/src/main/java/io/quarkus/undertow/runtime/UndertowDeploymentRecorder.java

+        Set<String> disallowedMethods = servletRuntimeConfig.getValue().disallowedMethods()
+                .map(list -> {
+                    Set<String> result = new java.util.HashSet<>();
+                    for (String m : list) {
+                        result.add(m.trim().toUpperCase(Locale.ROOT));
+                    }
+                    return result;
+                })
+                .orElse(Collections.emptySet());


Let's please avoid these lambdas

Sure, I’ve replaced the Optional.map with an explicit loop inside the recorder, so the code is now more straightforward @geoand

geoand · 2025-11-23T07:02:40Z

Thanks for the PR.

IIUC, the description of the PR is not correct as there are no listener related properties

geoand · 2025-11-24T07:31:56Z

docs/src/main/asciidoc/http-reference.adoc

+|===
+|Configuration property |Type |Default |Description
+
+|`quarkus.undertow.listener.disallowed-methods`


This is not correct, as the property is quarkus.undertow.disallowed-methods

geoand · 2025-11-24T07:32:01Z

docs/src/main/asciidoc/http-reference.adoc

+
+Example:
+----
+quarkus.undertow.listener.disallowed-methods=TRACE,TRACK


geoand · 2025-11-24T07:32:12Z

docs/src/main/asciidoc/http-reference.adoc

+quarkus.undertow.listener.disallowed-methods=TRACE,TRACK
+----
+
+|`quarkus.undertow.listener.record-request-start-time`


geoand · 2025-11-24T07:32:17Z

docs/src/main/asciidoc/http-reference.adoc

+|If enabled, Undertow records the request start timestamp.
+Useful for timing, logging and request tracing.
+
+|`quarkus.undertow.listener.max-parameters`


…ecord-request-start-time)

quarkus-bot · 2025-11-24T15:09:08Z

Status for workflow `Quarkus Documentation CI`

This is the status report for running Quarkus Documentation CI on commit 2fdbc27.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

Warning

There are other workflow runs running, you probably need to wait for their status before merging.

quarkus-bot bot added area/documentation area/undertow labels Nov 22, 2025

This comment has been minimized.

Sign in to view

mathias82 mentioned this pull request Nov 22, 2025

Enable configuration of Undertow listener attributes (disallowed-methods, record-request-start-time, max-parameters) #51180

Open

This comment has been minimized.

Sign in to view

mathias82 force-pushed the undertow-listener-config branch from cf8cc5a to 0678b3b Compare November 22, 2025 22:06

This comment has been minimized.

Sign in to view

mathias82 force-pushed the undertow-listener-config branch 2 times, most recently from cb3e0d5 to f8a5e60 Compare November 22, 2025 23:37

This comment has been minimized.

Sign in to view

quarkus-bot bot added the triage/flaky-test label Nov 23, 2025

geoand reviewed Nov 23, 2025

View reviewed changes

geoand changed the title ~~Expose Undertow listener configuration options (disallowed-methods, record-request-start-time, max-parameters)~~ Expose Undertow listener configuration options Nov 23, 2025

This comment has been minimized.

Sign in to view

mathias82 force-pushed the undertow-listener-config branch 3 times, most recently from ec81927 to 157b6cb Compare November 23, 2025 10:40

This comment has been minimized.

Sign in to view

mathias82 force-pushed the undertow-listener-config branch from 157b6cb to 16cc93c Compare November 23, 2025 10:57

This comment has been minimized.

Sign in to view

mathias82 force-pushed the undertow-listener-config branch from 91b4f6d to 3c55137 Compare November 23, 2025 11:38

This comment has been minimized.

Sign in to view

mathias82 force-pushed the undertow-listener-config branch from a36afc9 to 898a0cc Compare November 23, 2025 12:03

This comment has been minimized.

Sign in to view

geoand reviewed Nov 24, 2025

View reviewed changes

mathias82 force-pushed the undertow-listener-config branch from 898a0cc to 8009a6a Compare November 24, 2025 07:58

quarkus-bot bot added area/docstyle issues related for manual docstyle review area/oidc labels Nov 24, 2025

This comment has been minimized.

Sign in to view

mathias82 force-pushed the undertow-listener-config branch from 127fb39 to a840319 Compare November 24, 2025 09:21

geoand approved these changes Nov 24, 2025

View reviewed changes

geoand force-pushed the undertow-listener-config branch from a840319 to 28a2486 Compare November 24, 2025 09:25

mathias82 force-pushed the undertow-listener-config branch 2 times, most recently from 0348d4e to e8209c9 Compare November 24, 2025 09:42

quarkus-bot bot added area/core area/devtools Issues/PR related to maven, gradle, platform and cli tooling/plugins area/maven area/panache labels Nov 24, 2025

mathias82 force-pushed the undertow-listener-config branch from e8209c9 to 867a4ce Compare November 24, 2025 10:00

This comment has been minimized.

Sign in to view

mathias82 force-pushed the undertow-listener-config branch from c7d44d5 to 867a4ce Compare November 24, 2025 10:38

This comment has been minimized.

Sign in to view

matthaios.stavrou added 2 commits November 24, 2025 16:38

Expose Undertow listener configuration options (disallowed-methods, r…

4102e20

…ecord-request-start-time)

Fixed spaces in documentation

2fdbc27

mathias82 force-pushed the undertow-listener-config branch from 39db9e6 to 2fdbc27 Compare November 24, 2025 14:38

Expose Undertow listener configuration options #51182

Are you sure you want to change the base?

Expose Undertow listener configuration options #51182

Conversation

mathias82 commented Nov 22, 2025 • edited by geoand Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Added configuration properties

Motivation

Documentation

Notes

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions bot commented Nov 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

geoand commented Nov 23, 2025

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

quarkus-bot bot commented Nov 24, 2025

Status for workflow Quarkus Documentation CI

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mathias82 commented Nov 22, 2025 •

edited by geoand

Loading

github-actions bot commented Nov 22, 2025 •

edited

Loading

Status for workflow `Quarkus Documentation CI`