2.2.6-SNAPSHOT

analytics/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>timely</groupId>
     <artifactId>timely</artifactId>
-    <version>2.2.2</version>
+    <version>2.2.6-SNAPSHOT</version>
   </parent>
   <artifactId>timely-analytics</artifactId>
   <!--

balancer/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>timely</groupId>
     <artifactId>timely</artifactId>
-    <version>2.2.2</version>
+    <version>2.2.6-SNAPSHOT</version>
   </parent>
   <artifactId>timely-balancer</artifactId>
   <description>Timely Balancer</description>

balancer/src/main/dist/assembly.xml

@@ -46,12 +46,5 @@
         <include>*</include>
       </includes>
      </fileSet>
-	<fileSet>
-	  <directory>${project.basedir}/src/main/resources/webapp</directory>
-	  <outputDirectory>bin/webapp</outputDirectory>
-	  <includes>
-		<include>*</include>
-	  </includes>
-	</fileSet>
   </fileSets>
 </assembly>

balancer/src/main/java/timely/balancer/Balancer.java

@@ -83,8 +83,10 @@ import timely.common.configuration.SecurityProperties;
 import timely.common.configuration.SslClientProperties;
 import timely.common.configuration.SslServerProperties;
 import timely.common.configuration.ZookeeperProperties;
-import timely.netty.http.HttpStaticFileServerHandler;
-import timely.netty.http.NonSslRedirectHandler;
+import timely.netty.http.HttpStrictTransportSecurityHandler;
+import timely.netty.http.HttpVersionRequestHandler;
+import timely.netty.http.NonSslForbiddenHandler;
+import timely.netty.http.NotFoundHandler;
 import timely.netty.http.TimelyExceptionHandler;
 import timely.netty.http.auth.X509LoginRequestHandler;
 import timely.netty.tcp.MetricsBufferDecoder;
@@ -417,8 +419,9 @@ public class Balancer {
             @Override
             protected void initChannel(SocketChannel ch) {
 
-                ch.pipeline().addLast("ssl", new NonSslRedirectHandler(balancerHttpProperties, sslCtx));
+                ch.pipeline().addLast("nonsslforbidden", new NonSslForbiddenHandler(sslCtx));
                 ch.pipeline().addLast("encoder", new HttpResponseEncoder());
+                ch.pipeline().addLast("strict", new HttpStrictTransportSecurityHandler(balancerHttpProperties));
                 ch.pipeline().addLast("decoder", new HttpRequestDecoder(4096, 32768, 8192, true, 128));
                 ch.pipeline().addLast("compressor", new HttpContentCompressor());
                 ch.pipeline().addLast("decompressor", new HttpContentDecompressor());
@@ -426,9 +429,9 @@ public class Balancer {
                 ch.pipeline().addLast("chunker", new ChunkedWriteHandler());
                 ch.pipeline().addLast("queryDecoder",
                                 new timely.netty.http.HttpRequestDecoder(authenticationService, securityProperties, balancerHttpProperties));
-                ch.pipeline().addLast("fileServer",
-                                new HttpStaticFileServerHandler().setIgnoreSslHandshakeErrors(sslServerProperties.isIgnoreSslHandshakeErrors()));
+                ch.pipeline().addLast("notfound", new NotFoundHandler());
                 ch.pipeline().addLast("login", new X509LoginRequestHandler(authenticationService, securityProperties, balancerHttpProperties));
+                ch.pipeline().addLast("version", new HttpVersionRequestHandler());
                 ch.pipeline().addLast("httpRelay", new HttpRelayHandler(balancerHttpProperties, metricResolver, httpClientPool));
                 ch.pipeline().addLast("error", new TimelyExceptionHandler().setIgnoreSslHandshakeErrors(sslServerProperties.isIgnoreSslHandshakeErrors()));
             }

balancer/src/test/java/timely/balancer/integration/HTTPStrictTransportSecurityIT.java

@@ -0,0 +1,95 @@
+package timely.balancer.integration;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+import java.net.HttpURLConnection;
+import java.net.URL;
+
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSocketFactory;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.experimental.categories.Category;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.junit4.SpringRunner;
+
+import timely.balancer.configuration.BalancerHttpProperties;
+import timely.netty.http.HttpStrictTransportSecurityHandler;
+import timely.test.IntegrationTest;
+import timely.test.TimelyTestRule;
+
+@Category(IntegrationTest.class)
+@RunWith(SpringRunner.class)
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
+public class HTTPStrictTransportSecurityIT {
+
+    @Autowired
+    @Rule
+    public TimelyTestRule testRule;
+
+    @Autowired
+    private BalancerHttpProperties httpProperties;
+
+    @Autowired
+    protected SSLContext clientSslContext;
+
+    private String baseHttpUrl;
+    private String baseHttpsUrl;
+    private String HSTS_HEADER_VALUE;
+
+    @Before
+    public void setup() {
+        baseHttpUrl = "http://" + httpProperties.getHost() + ":" + httpProperties.getPort();
+        baseHttpsUrl = "https://" + httpProperties.getHost() + ":" + httpProperties.getPort();
+        HSTS_HEADER_VALUE = String.format("max-age=%d; includeSubDomains; preload", httpProperties.getStrictTransportMaxAge());
+    }
+
+    protected SSLSocketFactory getSSLSocketFactory() throws Exception {
+        return clientSslContext.getSocketFactory();
+    }
+
+    protected HttpsURLConnection getUrlConnection(URL url) throws Exception {
+        HttpsURLConnection.setDefaultSSLSocketFactory(getSSLSocketFactory());
+        HttpsURLConnection con = (HttpsURLConnection) url.openConnection();
+        con.setHostnameVerifier((host, session) -> true);
+        return con;
+    }
+
+    @Test
+    public void testHttpRequest() throws Exception {
+        URL url = new URL(baseHttpUrl + "/api/metrics");
+        HttpURLConnection con = (HttpURLConnection) url.openConnection();
+        con.setRequestMethod("GET");
+        int responseCode = con.getResponseCode();
+        assertEquals(403, responseCode);
+        // should not have HSTS header on HTTP response
+        assertNull(con.getHeaderField(HttpStrictTransportSecurityHandler.HSTS_HEADER_NAME));
+        con.disconnect();
+    }
+
+    @Test
+    public void testHttpsRequestHSTS() throws Exception {
+        URL url = new URL(baseHttpsUrl + "/version");
+        HttpsURLConnection con = getUrlConnection(url);
+        int responseCode = con.getResponseCode();
+        assertEquals(200, responseCode);
+        assertEquals(HSTS_HEADER_VALUE, con.getHeaderField(HttpStrictTransportSecurityHandler.HSTS_HEADER_NAME));
+        con.disconnect();
+    }
+
+    @Test
+    public void testHttpsRequestNotFound() throws Exception {
+        URL url = new URL(baseHttpsUrl);
+        HttpsURLConnection con = getUrlConnection(url);
+        int responseCode = con.getResponseCode();
+        assertEquals(404, responseCode);
+        assertEquals(HSTS_HEADER_VALUE, con.getHeaderField(HttpStrictTransportSecurityHandler.HSTS_HEADER_NAME));
+        con.disconnect();
+    }
+}

client/pom.xml

@@ -4,13 +4,13 @@
   <parent>
     <groupId>timely</groupId>
     <artifactId>timely</artifactId>
-    <version>2.2.2</version>
+    <version>2.2.6-SNAPSHOT</version>
   </parent>
   <artifactId>timely-client</artifactId>
   <properties>
     <!-- PEP 440 compliant version gets substituted into src/main/python/template/setup.py -->
     <!-- use .dev0 instead of -SNAPSHOT -->
-    <python.client.version>2.2.2</python.client.version>
+    <python.client.version>2.2.6.dev0</python.client.version>
   </properties>
   <dependencies>
     <dependency>

collectd/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>timely</groupId>
     <artifactId>timely</artifactId>
-    <version>2.2.2</version>
+    <version>2.2.6-SNAPSHOT</version>
   </parent>
   <artifactId>timely-collectd</artifactId>
   <dependencies>

common/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>timely</groupId>
     <artifactId>timely</artifactId>
-    <version>2.2.2</version>
+    <version>2.2.6-SNAPSHOT</version>
   </parent>
   <artifactId>timely-common</artifactId>
   <dependencies>

common/src/main/java/timely/api/response/StrictTransportResponse.java

@@ -1,5 +0,0 @@
-package timely.api.response;
-
-public class StrictTransportResponse {
-
-}

common/src/main/java/timely/common/configuration/HttpProperties.java

@@ -20,7 +20,6 @@ public class HttpProperties {
     private Integer basePort;
     @NotNull
     private String host;
-    private String redirectPath = "/secure-me";
     private long strictTransportMaxAge = 604800;
     @Valid
     @NestedConfigurationProperty
@@ -58,14 +57,6 @@ public class HttpProperties {
         this.host = host;
     }
 
-    public String getRedirectPath() {
-        return redirectPath;
-    }
-
-    public void setRedirectPath(String redirectPath) {
-        this.redirectPath = redirectPath;
-    }
-
     public long getStrictTransportMaxAge() {
         return strictTransportMaxAge;
     }

common/src/main/java/timely/netty/http/HttpRequestDecoder.java

@@ -27,7 +27,6 @@ import timely.api.request.AuthenticatedRequest;
 import timely.api.request.HttpGetRequest;
 import timely.api.request.HttpPostRequest;
 import timely.api.request.HttpRequest;
-import timely.api.response.StrictTransportResponse;
 import timely.api.response.TimelyException;
 import timely.auth.SubjectIssuerDNPair;
 import timely.auth.TimelyAuthenticationToken;
@@ -45,13 +44,11 @@ public class HttpRequestDecoder extends MessageToMessageDecoder<FullHttpRequest>
     private static final String LOG_PARSED_REQUEST = "Parsed request {}";
 
     protected SecurityProperties securityProperties;
-    private final String nonSecureRedirectAddress;
     private AuthenticationService authenticationService;
 
     public HttpRequestDecoder(AuthenticationService authenticationService, SecurityProperties securityProperties, HttpProperties httpProperties) {
 
         this.securityProperties = securityProperties;
-        this.nonSecureRedirectAddress = httpProperties.getRedirectPath();
         this.authenticationService = authenticationService;
     }
 
@@ -82,11 +79,6 @@ public class HttpRequestDecoder extends MessageToMessageDecoder<FullHttpRequest>
 
         final String uri = msg.uri();
         final QueryStringDecoder decoder = new QueryStringDecoder(uri);
-        if (decoder.path().equals(nonSecureRedirectAddress)) {
-            out.add(new StrictTransportResponse());
-            return;
-        }
-
         final String sessionId = getSessionId(msg);
         log.trace("SessionID: " + sessionId);
 

common/src/main/java/timely/netty/http/HttpStaticFileServerHandler.java

@@ -1,385 +0,0 @@
-/*
- * Copyright 2012 The Netty Project
- *
- * The Netty Project licenses this file to you under the Apache License,
- * version 2.0 (the "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at:
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations
- * under the License.
- */
-package timely.netty.http;
-
-import static io.netty.handler.codec.http.HttpHeaderNames.CACHE_CONTROL;
-import static io.netty.handler.codec.http.HttpHeaderNames.CONNECTION;
-import static io.netty.handler.codec.http.HttpHeaderNames.CONTENT_TYPE;
-import static io.netty.handler.codec.http.HttpHeaderNames.DATE;
-import static io.netty.handler.codec.http.HttpHeaderNames.EXPIRES;
-import static io.netty.handler.codec.http.HttpHeaderNames.IF_MODIFIED_SINCE;
-import static io.netty.handler.codec.http.HttpHeaderNames.LAST_MODIFIED;
-import static io.netty.handler.codec.http.HttpHeaderNames.LOCATION;
-import static io.netty.handler.codec.http.HttpMethod.GET;
-import static io.netty.handler.codec.http.HttpResponseStatus.BAD_REQUEST;
-import static io.netty.handler.codec.http.HttpResponseStatus.FORBIDDEN;
-import static io.netty.handler.codec.http.HttpResponseStatus.FOUND;
-import static io.netty.handler.codec.http.HttpResponseStatus.INTERNAL_SERVER_ERROR;
-import static io.netty.handler.codec.http.HttpResponseStatus.METHOD_NOT_ALLOWED;
-import static io.netty.handler.codec.http.HttpResponseStatus.NOT_FOUND;
-import static io.netty.handler.codec.http.HttpResponseStatus.NOT_MODIFIED;
-import static io.netty.handler.codec.http.HttpResponseStatus.OK;
-import static io.netty.handler.codec.http.HttpVersion.HTTP_1_1;
-
-import java.io.File;
-import java.io.FileNotFoundException;
-import java.io.RandomAccessFile;
-import java.io.UnsupportedEncodingException;
-import java.net.URLDecoder;
-import java.text.SimpleDateFormat;
-import java.util.Calendar;
-import java.util.Date;
-import java.util.GregorianCalendar;
-import java.util.Locale;
-import java.util.TimeZone;
-import java.util.regex.Pattern;
-
-import javax.activation.MimetypesFileTypeMap;
-import javax.net.ssl.SSLHandshakeException;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import io.netty.buffer.ByteBuf;
-import io.netty.buffer.Unpooled;
-import io.netty.channel.ChannelFutureListener;
-import io.netty.channel.ChannelHandlerContext;
-import io.netty.channel.SimpleChannelInboundHandler;
-import io.netty.handler.codec.http.DefaultFullHttpResponse;
-import io.netty.handler.codec.http.DefaultHttpResponse;
-import io.netty.handler.codec.http.FullHttpRequest;
-import io.netty.handler.codec.http.FullHttpResponse;
-import io.netty.handler.codec.http.HttpChunkedInput;
-import io.netty.handler.codec.http.HttpHeaderValues;
-import io.netty.handler.codec.http.HttpResponse;
-import io.netty.handler.codec.http.HttpResponseStatus;
-import io.netty.handler.codec.http.HttpUtil;
-import io.netty.handler.stream.ChunkedFile;
-import io.netty.util.CharsetUtil;
-import io.netty.util.internal.SystemPropertyUtil;
-import timely.netty.Constants;
-
-/**
- * A simple handler that serves incoming HTTP requests to send their respective HTTP responses. It also implements {@code 'If-Modified-Since'} header to take
- * advantage of browser cache, as described in <a href="http://tools.ietf.org/html/rfc2616#section-14.25">RFC 2616</a>.
- *
- * <h3>How Browser Caching Works</h3>
- *
- * Web browser caching works with HTTP headers as illustrated by the following sample:
- * <ol>
- * <li>Request #1 returns the content of {@code /file1.txt}.</li>
- * <li>Contents of {@code /file1.txt} is cached by the browser.</li>
- * <li>Request #2 for {@code /file1.txt} does return the contents of the file again. Rather, a 304 Not Modified is returned. This tells the browser to use the
- * contents stored in its cache.</li>
- * <li>The server knows the file has not been modified because the {@code If-Modified-Since} date is the same as the file's last modified date.</li>
- * </ol>
- *
- * <pre>
- * Request #1 Headers
- * ===================
- * GET /file1.txt HTTP/1.1
- *
- * Response #1 Headers
- * ===================
- * HTTP/1.1 200 OK
- * Date:               Tue, 01 Mar 2011 22:44:26 GMT
- * Last-Modified:      Wed, 30 Jun 2010 21:36:48 GMT
- * Expires:            Tue, 01 Mar 2012 22:44:26 GMT
- * Cache-Control:      private, max-age=31536000
- *
- * Request #2 Headers
- * ===================
- * GET /file1.txt HTTP/1.1
- * If-Modified-Since:  Wed, 30 Jun 2010 21:36:48 GMT
- *
- * Response #2 Headers
- * ===================
- * HTTP/1.1 304 Not Modified
- * Date:               Tue, 01 Mar 2011 22:44:28 GMT
- *
- * </pre>
- */
-public class HttpStaticFileServerHandler extends SimpleChannelInboundHandler<FullHttpRequest> implements TimelyHttpHandler {
-
-    private static final Logger log = LoggerFactory.getLogger(HttpStaticFileServerHandler.class);
-    public static final String HTTP_DATE_FORMAT = "EEE, dd MMM yyyy HH:mm:ss zzz";
-    public static final String HTTP_DATE_GMT_TIMEZONE = "GMT";
-    public static final int HTTP_CACHE_SECONDS = 60;
-    private boolean ignoreSslHandshakeErrors = false;
-
-    @Override
-    public void channelRead0(ChannelHandlerContext ctx, FullHttpRequest request) throws Exception {
-        if (!request.decoderResult().isSuccess()) {
-            sendError(ctx, BAD_REQUEST);
-            return;
-        }
-
-        if (request.method() != GET) {
-            sendError(ctx, METHOD_NOT_ALLOWED);
-            return;
-        }
-
-        String uri = request.uri();
-        if (uri.startsWith("/favicon.ico")) {
-            uri = uri.replaceFirst("\\/", "/webapp/");
-        }
-
-        if (!uri.startsWith("/webapp")) {
-            sendError(ctx, FORBIDDEN);
-            return;
-        }
-
-        final String path = sanitizeUri(uri);
-        if (path == null) {
-            sendError(ctx, FORBIDDEN);
-            return;
-        }
-
-        log.trace("Looking for requested file at: " + path);
-
-        File file = new File(path);
-        if (file.isHidden() || !file.exists()) {
-            sendError(ctx, NOT_FOUND);
-            return;
-        }
-
-        if (file.isDirectory()) {
-            if (uri.endsWith("/")) {
-                sendListing(ctx, file);
-            } else {
-                sendRedirect(ctx, uri + '/');
-            }
-            return;
-        }
-
-        if (!file.isFile()) {
-            sendError(ctx, FORBIDDEN);
-            return;
-        }
-
-        // Cache Validation
-        String ifModifiedSince = request.headers().get(IF_MODIFIED_SINCE);
-        if (ifModifiedSince != null && !ifModifiedSince.isEmpty()) {
-            SimpleDateFormat dateFormatter = new SimpleDateFormat(HTTP_DATE_FORMAT, Locale.US);
-            Date ifModifiedSinceDate = dateFormatter.parse(ifModifiedSince);
-
-            // Only compare up to the second because the datetime format we send
-            // to the client
-            // does not have milliseconds
-            long ifModifiedSinceDateSeconds = ifModifiedSinceDate.getTime() / 1000;
-            long fileLastModifiedSeconds = file.lastModified() / 1000;
-            if (ifModifiedSinceDateSeconds == fileLastModifiedSeconds) {
-                sendNotModified(ctx);
-                return;
-            }
-        }
-
-        RandomAccessFile raf;
-        try {
-            raf = new RandomAccessFile(file, "r");
-        } catch (FileNotFoundException ignore) {
-            sendError(ctx, NOT_FOUND);
-            return;
-        }
-
-        long fileLength = raf.length();
-
-        HttpResponse response = new DefaultHttpResponse(HTTP_1_1, OK);
-        HttpUtil.setContentLength(response, fileLength);
-        setContentTypeHeader(response, file);
-        setDateAndCacheHeaders(response, file);
-        HttpUtil.setTransferEncodingChunked(response, true);
-        if (HttpUtil.isKeepAlive(request)) {
-            response.headers().set(CONNECTION, HttpHeaderValues.KEEP_ALIVE);
-        }
-
-        // Write the initial line and the header.
-        sendResponse(ctx, response);
-        log.trace("Returning {}", response);
-
-        // Write the content.
-        sendResponse(ctx, new HttpChunkedInput(new ChunkedFile(raf, 0, fileLength, 8192)));
-
-    }
-
-    @Override
-    public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) {
-        // ignore SSLHandshakeException when using a self-signed server certificate
-        if (ignoreSslHandshakeErrors && cause.getCause() instanceof SSLHandshakeException) {
-            return;
-        }
-        log.error("Error serving file", cause);
-        if (ctx.channel().isActive()) {
-            sendError(ctx, INTERNAL_SERVER_ERROR);
-        }
-    }
-
-    private static final Pattern INSECURE_URI = Pattern.compile(".*[<>&\"].*");
-
-    private static String sanitizeUri(String uri) {
-        // Decode the path.
-        try {
-            uri = URLDecoder.decode(uri, "UTF-8");
-        } catch (UnsupportedEncodingException e) {
-            throw new Error(e);
-        }
-
-        if (uri.isEmpty() || uri.charAt(0) != '/') {
-            return null;
-        }
-
-        // Convert file separators.
-        uri = uri.replace('/', File.separatorChar);
-
-        // Simplistic dumb security check.
-        // You will have to do something serious in the production environment.
-        if (uri.contains(File.separator + '.') || uri.contains('.' + File.separator) || uri.charAt(0) == '.' || uri.charAt(uri.length() - 1) == '.'
-                        || INSECURE_URI.matcher(uri).matches()) {
-            return null;
-        }
-
-        // Convert to absolute path.
-        return SystemPropertyUtil.get("user.dir") + File.separator + uri;
-    }
-
-    private static final Pattern ALLOWED_FILE_NAME = Pattern.compile("[A-Za-z0-9][-_A-Za-z0-9\\.]*");
-
-    private static void sendListing(ChannelHandlerContext ctx, File dir) {
-        FullHttpResponse response = new DefaultFullHttpResponse(HTTP_1_1, OK);
-        response.headers().set(CONTENT_TYPE, "text/html; charset=UTF-8");
-
-        String dirPath = dir.getPath();
-        StringBuilder buf = new StringBuilder().append("<!DOCTYPE html>\r\n").append("<html><head><title>").append("Listing of: ").append(dirPath)
-                        .append("</title></head><body>\r\n")
-
-                        .append("<h3>Listing of: ").append(dirPath).append("</h3>\r\n")
-
-                        .append("<ul>").append("<li><a href=\"../\">..</a></li>\r\n");
-
-        File[] files = dir.listFiles();
-        if (null != files) {
-            for (File f : files) {
-                if (f.isHidden() || !f.canRead()) {
-                    continue;
-                }
-
-                String name = f.getName();
-                if (!ALLOWED_FILE_NAME.matcher(name).matches()) {
-                    continue;
-                }
-
-                buf.append("<li><a href=\"").append(name).append("\">").append(name).append("</a></li>\r\n");
-            }
-        }
-
-        buf.append("</ul></body></html>\r\n");
-        ByteBuf buffer = Unpooled.copiedBuffer(buf, CharsetUtil.UTF_8);
-        response.content().writeBytes(buffer);
-        buffer.release();
-
-        // Close the connection as soon as the error message is sent.
-        ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
-        log.trace(Constants.LOG_RETURNING_RESPONSE, response);
-    }
-
-    private static void sendRedirect(ChannelHandlerContext ctx, String newUri) {
-        FullHttpResponse response = new DefaultFullHttpResponse(HTTP_1_1, FOUND);
-        response.headers().set(LOCATION, newUri);
-
-        // Close the connection as soon as the error message is sent.
-        ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
-        log.trace(Constants.LOG_RETURNING_RESPONSE, response);
-    }
-
-    private static void sendError(ChannelHandlerContext ctx, HttpResponseStatus status) {
-        FullHttpResponse response = new DefaultFullHttpResponse(HTTP_1_1, status, Unpooled.copiedBuffer("Failure: " + status + "\r\n", CharsetUtil.UTF_8));
-        response.headers().set(CONTENT_TYPE, "text/plain; charset=UTF-8");
-
-        // Close the connection as soon as the error message is sent.
-        ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
-        log.trace(Constants.LOG_RETURNING_RESPONSE, response);
-    }
-
-    /**
-     * When file timestamp is the same as what the browser is sending up, send a "304 Not Modified"
-     *
-     * @param ctx
-     *            Context
-     */
-    private static void sendNotModified(ChannelHandlerContext ctx) {
-        FullHttpResponse response = new DefaultFullHttpResponse(HTTP_1_1, NOT_MODIFIED);
-        setDateHeader(response);
-
-        // Close the connection as soon as the error message is sent.
-        ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
-        log.trace(Constants.LOG_RETURNING_RESPONSE, response);
-    }
-
-    /**
-     * Sets the Date header for the HTTP response
-     *
-     * @param response
-     *            HTTP response
-     */
-    private static void setDateHeader(FullHttpResponse response) {
-        SimpleDateFormat dateFormatter = new SimpleDateFormat(HTTP_DATE_FORMAT, Locale.US);
-        dateFormatter.setTimeZone(TimeZone.getTimeZone(HTTP_DATE_GMT_TIMEZONE));
-
-        Calendar time = new GregorianCalendar();
-        response.headers().set(DATE, dateFormatter.format(time.getTime()));
-    }
-
-    /**
-     * Sets the Date and Cache headers for the HTTP Response
-     *
-     * @param response
-     *            HTTP response
-     * @param fileToCache
-     *            file to extract content type
-     */
-    private static void setDateAndCacheHeaders(HttpResponse response, File fileToCache) {
-        SimpleDateFormat dateFormatter = new SimpleDateFormat(HTTP_DATE_FORMAT, Locale.US);
-        dateFormatter.setTimeZone(TimeZone.getTimeZone(HTTP_DATE_GMT_TIMEZONE));
-
-        // Date header
-        Calendar time = new GregorianCalendar();
-        response.headers().set(DATE, dateFormatter.format(time.getTime()));
-
-        // Add cache headers
-        time.add(Calendar.SECOND, HTTP_CACHE_SECONDS);
-        response.headers().set(EXPIRES, dateFormatter.format(time.getTime()));
-        response.headers().set(CACHE_CONTROL, "private, max-age=" + HTTP_CACHE_SECONDS);
-        response.headers().set(LAST_MODIFIED, dateFormatter.format(new Date(fileToCache.lastModified())));
-    }
-
-    /**
-     * Sets the content type header for the HTTP Response
-     *
-     * @param response
-     *            HTTP response
-     * @param file
-     *            file to extract content type
-     */
-    private static void setContentTypeHeader(HttpResponse response, File file) {
-        MimetypesFileTypeMap mimeTypesMap = new MimetypesFileTypeMap();
-        response.headers().set(CONTENT_TYPE, mimeTypesMap.getContentType(file.getPath()));
-    }
-
-    public HttpStaticFileServerHandler setIgnoreSslHandshakeErrors(boolean ignoreSslHandshakeErrors) {
-        this.ignoreSslHandshakeErrors = ignoreSslHandshakeErrors;
-        return this;
-    }
-}

common/src/main/java/timely/netty/http/HttpStrictTransportSecurityHandler.java

@@ -0,0 +1,32 @@
+package timely.netty.http;
+
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelOutboundHandlerAdapter;
+import io.netty.channel.ChannelPromise;
+import io.netty.handler.codec.http.HttpResponse;
+import timely.common.configuration.HttpProperties;
+
+public class HttpStrictTransportSecurityHandler extends ChannelOutboundHandlerAdapter {
+
+    public static final String HSTS_HEADER_NAME = "Strict-Transport-Security";
+    private final String HSTS_HEADER_VALUE;
+
+    public HttpStrictTransportSecurityHandler(HttpProperties httpProperties) {
+        this.HSTS_HEADER_VALUE = String.format("max-age=%d; includeSubDomains; preload", httpProperties.getStrictTransportMaxAge());
+    }
+
+    @Override
+    public void write(ChannelHandlerContext ctx, Object msg, ChannelPromise promise) throws Exception {
+        // Check if the connection is SSL/TLS encrypted
+        boolean isHttps = ctx.channel().pipeline().get(io.netty.handler.ssl.SslHandler.class) != null;
+        if (isHttps && msg instanceof HttpResponse) {
+            HttpResponse response = (HttpResponse) msg;
+            // Add the HSTS header only if it isn't already present
+            if (!response.headers().contains(HSTS_HEADER_NAME)) {
+                response.headers().set(HSTS_HEADER_NAME, HSTS_HEADER_VALUE);
+            }
+        }
+        // Forward the message to the next handler in the pipeline
+        super.write(ctx, msg, promise);
+    }
+}

common/src/main/java/timely/netty/http/HttpVersionRequestHandler.java

@@ -1,4 +1,4 @@
-package timely.server.netty.http;
+package timely.netty.http;
 
 import java.nio.charset.StandardCharsets;
 
@@ -12,7 +12,6 @@ import io.netty.handler.codec.http.HttpResponseStatus;
 import io.netty.handler.codec.http.HttpVersion;
 import timely.api.request.VersionRequest;
 import timely.netty.Constants;
-import timely.netty.http.TimelyHttpHandler;
 
 public class HttpVersionRequestHandler extends SimpleChannelInboundHandler<VersionRequest> implements TimelyHttpHandler {
 

common/src/main/java/timely/netty/http/NonSslForbiddenHandler.java

@@ -0,0 +1,52 @@
+package timely.netty.http;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.netty.buffer.Unpooled;
+import io.netty.channel.ChannelFutureListener;
+import io.netty.channel.ChannelHandler;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelInboundHandlerAdapter;
+import io.netty.handler.ssl.OptionalSslHandler;
+import io.netty.handler.ssl.SslContext;
+import io.netty.util.CharsetUtil;
+import io.netty.util.ReferenceCountUtil;
+import timely.netty.Constants;
+
+public class NonSslForbiddenHandler extends OptionalSslHandler {
+
+    private static final Logger log = LoggerFactory.getLogger(NonSslForbiddenHandler.class);
+
+    public NonSslForbiddenHandler(SslContext sslContext) {
+        super(sslContext);
+    }
+
+    @Override
+    protected String newSslHandlerName() {
+        return "ssl";
+    }
+
+    @Override
+    protected String newNonSslHandlerName() {
+        return "nonSslForbidden";
+    }
+
+    @Override
+    protected ChannelHandler newNonSslHandler(ChannelHandlerContext context) {
+        return new ChannelInboundHandlerAdapter() {
+
+            @Override
+            public void channelRead(ChannelHandlerContext ctx, Object msg) {
+                try {
+                    log.trace("Received non-SSL request, returning forbidden");
+                    String response = "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n";
+                    log.trace(Constants.LOG_RETURNING_RESPONSE, response);
+                    ctx.writeAndFlush(Unpooled.copiedBuffer(response, CharsetUtil.UTF_8)).addListener(ChannelFutureListener.CLOSE);
+                } finally {
+                    ReferenceCountUtil.release(msg);
+                }
+            }
+        };
+    }
+}

common/src/main/java/timely/netty/http/NonSslRedirectHandler.java

@@ -1,62 +0,0 @@
-package timely.netty.http;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import io.netty.buffer.Unpooled;
-import io.netty.channel.ChannelHandler;
-import io.netty.channel.ChannelHandlerContext;
-import io.netty.channel.ChannelInboundHandlerAdapter;
-import io.netty.handler.codec.http.DefaultFullHttpResponse;
-import io.netty.handler.codec.http.FullHttpResponse;
-import io.netty.handler.codec.http.HttpHeaderNames;
-import io.netty.handler.codec.http.HttpResponseEncoder;
-import io.netty.handler.codec.http.HttpResponseStatus;
-import io.netty.handler.codec.http.HttpVersion;
-import io.netty.handler.ssl.OptionalSslHandler;
-import io.netty.handler.ssl.SslContext;
-import timely.common.configuration.HttpProperties;
-import timely.netty.Constants;
-
-public class NonSslRedirectHandler extends OptionalSslHandler implements TimelyHttpHandler {
-
-    private static final Logger log = LoggerFactory.getLogger(NonSslRedirectHandler.class);
-    private final String redirectAddress;
-
-    public NonSslRedirectHandler(HttpProperties httpProperties, SslContext sslContext) {
-        super(sslContext);
-        String timelyHost = httpProperties.getHost();
-        int timelyPort = httpProperties.getPort();
-        String path = httpProperties.getRedirectPath();
-        redirectAddress = "https://" + timelyHost + ":" + timelyPort + path;
-    }
-
-    @Override
-    protected String newSslHandlerName() {
-        return "ssl";
-    }
-
-    @Override
-    protected String newNonSslHandlerName() {
-        return "ssl";
-    }
-
-    @Override
-    protected ChannelHandler newNonSslHandler(ChannelHandlerContext context) {
-        return new ChannelInboundHandlerAdapter() {
-
-            private HttpResponseEncoder encoder = new HttpResponseEncoder();
-
-            @Override
-            public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
-                log.trace("Received non-SSL request, returning redirect");
-                FullHttpResponse response = new DefaultFullHttpResponse(HttpVersion.HTTP_1_1, HttpResponseStatus.MOVED_PERMANENTLY, Unpooled.EMPTY_BUFFER);
-                response.headers().set(HttpHeaderNames.LOCATION, redirectAddress);
-                log.trace(Constants.LOG_RETURNING_RESPONSE, response);
-                encoder.write(ctx, response, ctx.voidPromise());
-                ctx.flush();
-            }
-        };
-    }
-
-}

common/src/main/java/timely/netty/http/NotFoundHandler.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2012 The Netty Project
+ *
+ * The Netty Project licenses this file to you under the Apache License,
+ * version 2.0 (the "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at:
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+package timely.netty.http;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.netty.buffer.Unpooled;
+import io.netty.channel.ChannelFutureListener;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.SimpleChannelInboundHandler;
+import io.netty.handler.codec.http.DefaultFullHttpResponse;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.FullHttpResponse;
+import io.netty.handler.codec.http.HttpHeaderNames;
+import io.netty.handler.codec.http.HttpHeaderValues;
+import io.netty.handler.codec.http.HttpResponseStatus;
+import io.netty.handler.codec.http.HttpVersion;
+import timely.netty.Constants;
+
+public class NotFoundHandler extends SimpleChannelInboundHandler<FullHttpRequest> implements TimelyHttpHandler {
+
+    private static final Logger log = LoggerFactory.getLogger(NotFoundHandler.class);
+
+    @Override
+    public void channelRead0(ChannelHandlerContext ctx, FullHttpRequest request) throws Exception {
+        // if the request reaches this handler, it means that no other handler has processed it, so we return a 404 Not Found response
+        FullHttpResponse response = new DefaultFullHttpResponse(HttpVersion.HTTP_1_1, HttpResponseStatus.NOT_FOUND, Unpooled.EMPTY_BUFFER);
+        response.headers().set(HttpHeaderNames.CONTENT_LENGTH, 0);
+        log.trace(Constants.LOG_RETURNING_RESPONSE, response);
+        ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
+    }
+}

grafana/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>timely</groupId>
     <artifactId>timely</artifactId>
-    <version>2.2.2</version>
+    <version>2.2.6-SNAPSHOT</version>
   </parent>
   <artifactId>timely-datasource</artifactId>
   <packaging>pom</packaging>

grafana/timely-datasource/dist/plugin.json

@@ -31,8 +31,8 @@
             }
         ],
         "screenshots": [],
-        "version": "2.2.2",
-        "updated": "2026-05-11"
+        "version": "2.2.6-SNAPSHOT",
+        "updated": "2026-10-19"
     },
     "dependencies": {
         "grafanaDependency": ">=10.0.0",

grafana/timely-datasource/package.json

@@ -1,6 +1,6 @@
 {
   "name": "timely",
-  "version": "2.2.2",
+  "version": "2.2.6-SNAPSHOT",
   "scripts": {
     "build": "webpack -c ./.config/webpack/webpack.config.ts --env production",
     "dev": "webpack -w -c ./.config/webpack/webpack.config.ts --env development",

pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>timely</groupId>
   <artifactId>timely</artifactId>
-  <version>2.2.2</version>
+  <version>2.2.6-SNAPSHOT</version>
   <packaging>pom</packaging>
   <name>Timely</name>
   <description>A secure and scalable time series database based on Apache Accumulo</description>
@@ -34,8 +34,9 @@
   <properties>
     <assembly.tarLongFileMode>posix</assembly.tarLongFileMode>
     <docker.image.prefix>timely/</docker.image.prefix>
-    <maven.compiler.source>11</maven.compiler.source>
-    <maven.compiler.target>11</maven.compiler.target>
+    <java.version>11</java.version>
+    <maven.compiler.source>${java.version}</maven.compiler.source>
+    <maven.compiler.target>${java.version}</maven.compiler.target>
     <!-- Configure the os-maven-plugin extension to expand the classifier on -->
     <!-- Fedora-"like" systems. -->
     <os.detection.classifierWithLikes>fedora</os.detection.classifierWithLikes>
@@ -43,7 +44,7 @@
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <spotbugs.excludes.file>${project.basedir}/src/main/spotbugs/excludes.xml</spotbugs.excludes.file>
     <surefire.forkCount>1C</surefire.forkCount>
-    <version.accumulo>2.1.4</version.accumulo>
+    <version.accumulo>2.1.5</version.accumulo>
     <version.caffeine>3.1.8</version.caffeine>
     <version.classgraph>4.8.184</version.classgraph>
     <version.collectd>5.7.1</version.collectd>
@@ -55,7 +56,7 @@
     <version.commons-text>1.15.0</version.commons-text>
     <version.compression.gorilla>2.1.1</version.compression.gorilla>
     <version.curator>5.9.0</version.curator>
-    <version.datawave-in-memory-accumulo>3.0.1</version.datawave-in-memory-accumulo>
+    <version.datawave-in-memory-accumulo>4.0.6</version.datawave-in-memory-accumulo>
     <version.disruptor>3.4.4</version.disruptor>
     <version.easymock>5.6.0</version.easymock>
     <version.eclipse-lifecycle>1.0.0</version.eclipse-lifecycle>
@@ -73,7 +74,7 @@
     <version.jjwt>0.12.7</version.jjwt>
     <version.jsoup>1.22.2</version.jsoup>
     <version.junit>4.13.2</version.junit>
-    <version.log4j2>2.25.4</version.log4j2>
+    <version.log4j2>2.26.1</version.log4j2>
     <version.maven-assembly-plugin>3.6.0</version.maven-assembly-plugin>
     <version.maven-build-helper-plugin>3.5.0</version.maven-build-helper-plugin>
     <version.maven-buildnumber-plugin>1.4</version.maven-buildnumber-plugin>

server/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>timely</groupId>
     <artifactId>timely</artifactId>
-    <version>2.2.2</version>
+    <version>2.2.6-SNAPSHOT</version>
   </parent>
   <artifactId>timely-server</artifactId>
   <description>Timely Server</description>

server/src/main/dist/assembly.xml

@@ -67,12 +67,5 @@
         <include>*</include>
       </includes>
      </fileSet>
-	<fileSet>
-	  <directory>${project.basedir}/src/main/resources/webapp</directory>
-	  <outputDirectory>bin/webapp</outputDirectory>
-	  <includes>
-		<include>*</include>
-	  </includes>
-	</fileSet>
   </fileSets>
 </assembly>

server/src/main/java/timely/server/Server.java

@@ -84,8 +84,10 @@ import timely.common.configuration.ServerProperties;
 import timely.common.configuration.SslServerProperties;
 import timely.common.configuration.TimelyProperties;
 import timely.common.configuration.WebsocketProperties;
-import timely.netty.http.HttpStaticFileServerHandler;
-import timely.netty.http.NonSslRedirectHandler;
+import timely.netty.http.HttpStrictTransportSecurityHandler;
+import timely.netty.http.HttpVersionRequestHandler;
+import timely.netty.http.NonSslForbiddenHandler;
+import timely.netty.http.NotFoundHandler;
 import timely.netty.http.TimelyExceptionHandler;
 import timely.netty.http.auth.X509LoginRequestHandler;
 import timely.netty.tcp.MetricsBufferDecoder;
@@ -98,8 +100,6 @@ import timely.netty.websocket.WebSocketRequestDecoder;
 import timely.netty.websocket.subscription.WSTimelyExceptionHandler;
 import timely.server.netty.http.HttpCacheRequestHandler;
 import timely.server.netty.http.HttpMetricPutHandler;
-import timely.server.netty.http.HttpVersionRequestHandler;
-import timely.server.netty.http.StrictTransportHandler;
 import timely.server.netty.http.timeseries.HttpAggregatorsRequestHandler;
 import timely.server.netty.http.timeseries.HttpMetricsRequestHandler;
 import timely.server.netty.http.timeseries.HttpQueryRequestHandler;
@@ -488,8 +488,9 @@ public class Server {
 
     protected void setupHttpSocketChannel(SocketChannel ch, MetaCache metaCache, TimelyProperties timelyProperties, HttpProperties httpProperties,
                     SslContext sslCtx) {
-        ch.pipeline().addLast("ssl", new NonSslRedirectHandler(httpProperties, sslCtx));
+        ch.pipeline().addLast("nonsslforbidden", new NonSslForbiddenHandler(sslCtx));
         ch.pipeline().addLast("encoder", new HttpResponseEncoder());
+        ch.pipeline().addLast("strict", new HttpStrictTransportSecurityHandler(httpProperties));
         ch.pipeline().addLast("decoder", new HttpRequestDecoder(4096, 32768, 8192, true, 128));
         ch.pipeline().addLast("compressor", new HttpContentCompressor());
         ch.pipeline().addLast("decompressor", new HttpContentDecompressor());
@@ -513,8 +514,7 @@ public class Server {
         log.trace("Cors configuration: {}", cors);
         ch.pipeline().addLast("cors", new CorsHandler(cors));
         ch.pipeline().addLast("queryDecoder", new timely.netty.http.HttpRequestDecoder(authenticationService, securityProperties, httpProperties));
-        ch.pipeline().addLast("fileServer", new HttpStaticFileServerHandler().setIgnoreSslHandshakeErrors(sslServerProperties.isIgnoreSslHandshakeErrors()));
-        ch.pipeline().addLast("strict", new StrictTransportHandler(httpProperties));
+        ch.pipeline().addLast("notfound", new NotFoundHandler());
         ch.pipeline().addLast("login", new X509LoginRequestHandler(authenticationService, securityProperties, httpProperties));
         ch.pipeline().addLast("aggregators", new HttpAggregatorsRequestHandler());
         ch.pipeline().addLast("metrics", new HttpMetricsRequestHandler(metaCache, timelyProperties));

server/src/main/java/timely/server/netty/http/StrictTransportHandler.java

@@ -1,29 +0,0 @@
-package timely.server.netty.http;
-
-import io.netty.channel.ChannelHandlerContext;
-import io.netty.channel.SimpleChannelInboundHandler;
-import io.netty.handler.codec.http.HttpResponseStatus;
-import timely.api.response.StrictTransportResponse;
-import timely.api.response.TimelyException;
-import timely.common.configuration.HttpProperties;
-
-public class StrictTransportHandler extends SimpleChannelInboundHandler<StrictTransportResponse> {
-
-    public static final String HSTS_HEADER_NAME = "Strict-Transport-Security";
-    private HttpProperties httpProperties;
-
-    public StrictTransportHandler(HttpProperties httpProperties) {
-        this.httpProperties = httpProperties;
-    }
-
-    @Override
-    protected void channelRead0(ChannelHandlerContext ctx, StrictTransportResponse msg) throws Exception {
-        TimelyException e = new TimelyException(HttpResponseStatus.NOT_FOUND.code(), "Returning HTTP Strict Transport Security response", null, null);
-        String headerValue = "max-age=" + httpProperties.getStrictTransportMaxAge();
-        e.addResponseHeader(HSTS_HEADER_NAME, headerValue);
-        // Don't call sendHttpError from here, throw an error instead and let
-        // the exception handler catch it.
-        throw e;
-    }
-
-}

server/src/test/java/timely/server/integration/HTTPStrictTransportSecurityIT.java

@@ -1,6 +1,7 @@
 package timely.server.integration;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
 
 import java.net.HttpURLConnection;
 import java.net.URL;
@@ -18,9 +19,8 @@ import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.junit4.SpringRunner;
 
-import io.netty.handler.codec.http.HttpHeaderNames;
 import timely.common.configuration.HttpProperties;
-import timely.server.netty.http.StrictTransportHandler;
+import timely.netty.http.HttpStrictTransportSecurityHandler;
 import timely.test.IntegrationTest;
 import timely.test.TimelyTestRule;
 
@@ -39,12 +39,14 @@ public class HTTPStrictTransportSecurityIT extends OneWaySSLBase {
 
     private String baseHttpUrl;
     private String baseHttpsUrl;
+    private String HSTS_HEADER_VALUE;
 
     @Before
     public void setup() {
         super.setup();
         baseHttpUrl = "http://" + httpProperties.getHost() + ":" + httpProperties.getPort();
         baseHttpsUrl = "https://" + httpProperties.getHost() + ":" + httpProperties.getPort();
+        HSTS_HEADER_VALUE = String.format("max-age=%d; includeSubDomains; preload", httpProperties.getStrictTransportMaxAge());
     }
 
     @After
@@ -53,24 +55,34 @@ public class HTTPStrictTransportSecurityIT extends OneWaySSLBase {
     }
 
     @Test
-    public void testHttpRequestGet() throws Exception {
-        HttpURLConnection.setFollowRedirects(false);
+    public void testHttpRequest() throws Exception {
         URL url = new URL(baseHttpUrl + "/api/metrics");
         HttpURLConnection con = (HttpURLConnection) url.openConnection();
         con.setRequestMethod("GET");
         int responseCode = con.getResponseCode();
-        assertEquals(301, responseCode);
-        assertEquals(baseHttpsUrl + "/secure-me", con.getHeaderField(HttpHeaderNames.LOCATION.toString()));
+        assertEquals(403, responseCode);
+        // should not have HSTS header on HTTP response
+        assertNull(con.getHeaderField(HttpStrictTransportSecurityHandler.HSTS_HEADER_NAME));
         con.disconnect();
     }
 
     @Test
-    public void testHSTSRequestGet() throws Exception {
-        String secureMe = baseHttpsUrl + "/secure-me";
-        URL url = new URL(secureMe);
+    public void testHttpsRequestHSTS() throws Exception {
+        URL url = new URL(baseHttpsUrl + "/version");
+        HttpsURLConnection con = getUrlConnection(url);
+        int responseCode = con.getResponseCode();
+        assertEquals(200, responseCode);
+        assertEquals(HSTS_HEADER_VALUE, con.getHeaderField(HttpStrictTransportSecurityHandler.HSTS_HEADER_NAME));
+        con.disconnect();
+    }
+
+    @Test
+    public void testHttpsRequestNotFound() throws Exception {
+        URL url = new URL(baseHttpsUrl);
         HttpsURLConnection con = getUrlConnection(url);
         int responseCode = con.getResponseCode();
         assertEquals(404, responseCode);
-        assertEquals("max-age=" + httpProperties.getStrictTransportMaxAge(), con.getHeaderField(StrictTransportHandler.HSTS_HEADER_NAME));
+        assertEquals(HSTS_HEADER_VALUE, con.getHeaderField(HttpStrictTransportSecurityHandler.HSTS_HEADER_NAME));
+        con.disconnect();
     }
 }

server/src/test/java/timely/server/integration/StaticFileServerIT.java

@@ -1,55 +0,0 @@
-package timely.server.integration;
-
-import org.junit.*;
-import org.junit.experimental.categories.Category;
-import org.junit.runner.RunWith;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.junit4.SpringRunner;
-
-import timely.common.configuration.HttpProperties;
-import timely.test.IntegrationTest;
-import timely.test.TimelyTestRule;
-
-@Category(IntegrationTest.class)
-@RunWith(SpringRunner.class)
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
-@ActiveProfiles({"oneWaySsl"})
-public class StaticFileServerIT extends OneWaySSLBase {
-
-    private String baseUrl;
-
-    @Autowired
-    @Rule
-    public TimelyTestRule testRule;
-
-    @Autowired
-    private HttpProperties httpProperties;
-
-    @Before
-    public void setup() {
-        super.setup();
-        this.baseUrl = "https://" + httpProperties.getHost() + ":" + httpProperties.getPort();
-    }
-
-    @After
-    public void cleanup() {
-        super.cleanup();
-    }
-
-    @Test(expected = NotSuccessfulException.class)
-    public void testGetFavIconRequest() throws Exception {
-        query(baseUrl + "/favicon.ico", 404, "application/json");
-    }
-
-    @Test(expected = NotSuccessfulException.class)
-    public void testGetBadPath() throws Exception {
-        query(baseUrl + "/index.html", 403, "application/json");
-    }
-
-    @Test(expected = NotSuccessfulException.class)
-    public void testGetGoodPath() throws Exception {
-        query(baseUrl + "/webapp/test.html", 404, "application/json");
-    }
-}

test/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>timely</groupId>
     <artifactId>timely</artifactId>
-    <version>2.2.2</version>
+    <version>2.2.6-SNAPSHOT</version>
   </parent>
   <artifactId>timely-test</artifactId>
   <properties>