name

String

default

Can be used to distinguish between different HttpService instances.

httpEnabled

boolean

true

Should HTTP protocol be enabled?

plainPort

Integer

80

Primary HTTP port.

alternativePlainPort

Integer

8080

Alternative HTTP port, if the primary is busy.

httpsEnabled

boolean

false

Should HTTPS protocol be enabled?

http2Enabled

boolean

false

Should HTTP/2 protocol be enabled?

securePort

Integer

443

Primary HTTPS port.

alternativeSecurePort

Integer

4433

Alternative HTTPS port, if the primary is busy.

keystorePath

String

N/A

Path to a keystore file from which to load private credentials. If not set, the value of the system property 'javax.net.ssl.keyStore' will be used instead. To use a non file-based keystore (i.e. PKCS#11 hardware token), set the value of this property to 'NONE'.

keystorePassword

String

N/A

Password for the keystore file. If not set, the value of the system property 'javax.net.ssl.keyStorePassword' will be used instead.

keyStoreType

String

JKS

Keystore type. If not set, the value of the system property 'javax.net.ssl.keyStoreType' will be used instead.

trustStorePath

String

N/A

Path to a truststore file, containing trusted client certificates. If not set, the value of the system property 'javax.net.ssl.trustStore' will be used instead. To use a non file-based truststore (i.e. PKCS#11 hardware token), set the value of this property to 'NONE'.

trustStorePassword

String

N/A

Trust store password. If not set, the value of the system property 'javax.net.ssl.trustStorePassword' will be used instead.

trustStoreType

String

JKS

Trust store type. If not set, the value of the system property 'javax.net.ssl.trustStoreType' will be used instead.

sslProtocol

String

TLS

SSL protocol to use.

sslProvider

String

N/A

SSL provider to use. If not set, the value of the system property 'mbs.http.sslProvider' will be used instead.

sessionTimeout

Integer

1800

Default timeout in seconds for invalidating inactive javax.servlet.http.HttpSessions. Negative value indicates that sessions will never expire.

sessionCookieSameSitePolicy

String

Lax

SameSite policy for the session cookie. When set to 'None' it is recommended to set the sessionCookieSecure value to 'true'. Accepted values are:

• Strict
• Lax
• None

sessionCookieSecure

boolean

false

Secure policy for the session cookie. If set to 'true', session cookies will be available over HTTPS connections only.

sessionCookieHttpOnly

boolean

true

Should the session cookie be HTTP only? HttpOnly cookies are not accessible to JavaScript code.