<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
    <session-config>
        <session-timeout>
            30
        </session-timeout>
        <cookie-config>
            <http-only>true</http-only>
            <!--secure>true</secure-->
        </cookie-config>
        <tracking-mode>COOKIE</tracking-mode>
    </session-config>
    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
    </welcome-file-list>
    <security-role>
        <description>No access</description>
        <role-name>Restricted</role-name>
    </security-role>
    <security-constraint>
        <display-name>No access</display-name>
        <web-resource-collection>
            <web-resource-name>No access contstraint</web-resource-name>
            <description/>
            <url-pattern>/templates/*</url-pattern>
            <url-pattern>${restricted.resource.1}</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <description/>
            <role-name>Restricted</role-name>
        </auth-constraint>
    </security-constraint>

    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>INCLUDE</dispatcher>
        <dispatcher>ERROR</dispatcher>
    </filter-mapping>

    <!-- Apache shiro -->
    <listener>
        <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
    </listener>
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
    </filter>
    <filter>
        <filter-name>ResponseHeaderFilter</filter-name>
        <filter-class>com.pvstream.pilot.api.presentation.services.ResponseHeaderFilter</filter-class>
        <init-param>
            <param-name>Access-Control-Allow-Origin</param-name>
            <param-value>*</param-value>
        </init-param>
    </filter>
    <filter>
        <filter-name>SessionTimeoutCookieFilter</filter-name>
        <filter-class>com.pvstream.pilot.api.presentation.services.SessionTimeoutCookieFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>SessionTimeoutCookieFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    
</web-app>