# WebSocket Notification Service ESS provides a secure implementation of a WebSockets notification protocol. The ESS WebSocket Service publishes asynchronous notifications upon create/update/delete operations on a Resource, including a Container. {% hint style="info" %} Disambiguation\ The ESS WebSocket service is **not** an implementation of the [draft Solid WebSockets API Spec (version solid-0.1)](https://github.com/solid/solid-spec/blob/master/api-websockets.md) . The ESS WebSocket service is based on an earlier version of the [Solid Notifications Protocol](https://solid.github.io/notifications/protocol). {% endhint %} ## Client Subscriptions To receive notifications, a client subscribes to a particular Resource or Resources. A client can subscribe to a Resource that does not yet exist. {% tabs %} {% tab title="solid-client-notifications JS API" %} Using the **`@inrupt/solid-client-notifications`** library, applications can subscribe to WebSocket notifications. {% hint style="warning" %} To subscribe to a resource, the authenticated user must have **`Read`** access to the resource. {% endhint %} ```javascript import { getDefaultSession, fetch } from "@inrupt/solid-client-authn-browser"; import { WebsocketNotification, } from "@inrupt/solid-client-notifications"; const resourceURL = ...; // URL of the Resource to which to subscribe // ... authentication logic has been omitted const websocket = new WebsocketNotification( resourceURL, { fetch: fetch } // Authenticated fetch of a user with Read access ); websocket.on("message", console.log); websocket.connect(); ``` For more information, see: * [Subscribe to WebSocket Notifications](https://docs.inrupt.com/sdk/javascript-sdk/notifications) * [solid-client-notifications API](https://inrupt.github.io/solid-client-notifications-js/) {% endtab %} {% tab title="General Javascript API" %} The process for establishing a WebSocket connection starts at the Notification Gateway endpoint for ESS (e.g., **`https://notification./`** ). This endpoint allows clients to identify the protocols they support along with any particular features that are required. To determine your Notification Gateway endpoint, see [**`/.well-known/solid`**](https://github.com/inrupt/docs-gitbook/blob/main/ess/2.5/services/appendix/discovery.md#well-known-solid). 1. Clients can **`POST`** the following JSON document to the [ESS Notification Gateway](https://docs.inrupt.com/ess/2.5/services/service-notification/service-notification-gateway); no authentication is required: **`json { "protocols": ["ws"] }`** The response JSON contains the WebSocket endpoint that clients can access for login; for example: **`json { "endpoint": "https://websocket./", "features":[], "protocol":"ws" }`** 2. Clients can use the returned **`endpoint`** to subscribe to a resource. Authentication is required. {% hint style="warning" %} To subscribe to a resource, the authenticated user must have **`Read`** access to the resource. {% endhint %} To subscribe, clients can **`POST`** (using standard Solid authentication headers) a JSON document that specifies the Resource to which to subscribe: ```json { "topic": "" } ``` The response JSON returns the **`endpoint`** to establish the actual WebSocket connection: ```json { "endpoint": "wss://websocket./?s=", "protocol": "ws", "subprotocol": "solid-0.2" } ``` 3\. Using the returned **`endpoint`** and **`subprotocol`** , a client can connect to the WebSocket service, passing in the entire **`endpoint`** string and **`subprotocol`** string into the JavaScript [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSocket) constructor): ```javascript var ws = new WebSocket("", ""); ``` You must specify the subprotocol. Otherwise, the connection is dropped. {% hint style="info" %} **Note** The subprotocol string is subject to change as the ESS WebSocket notification protocol undergoes the Solid panel process. {% endhint %} Once the connection is established, all the standard [WebSocket methods](https://developer.mozilla.org/en-US/docs/Web/API/WebSocket#methods) can be used from the JavaScript API. {% endtab %} {% endtabs %} When subscribed to a particular Resource, the client sees all create/update/delete events for that particular Resource. If a client subscribes to a Container, the client receives events for the Container as well as for the Container’s child Resource; specifically, if a child Resource is created or deleted but not if a child Resource is modified. Clients should expect long-lived WebSocket connections to be terminated at any point in time. It is important that client code watch for **`WebSocket.onclose`** events and handle them by restarting the connection flow. ## Notification Event The ESS WebSocket service publishes each notification as a [W3C ActivityStream](https://www.w3.org/TR/activitystreams-core/) message, serialized as JSON-LD: ```javascript { "@context": [ "https://www.w3.org/ns/activitystreams", { "state": { "@id": "http://www.w3.org/2011/http-headers#etag" } } ], "id": "urn:uuid:", "type": [ "http://www.w3.org/ns/prov#Activity", "" ], "object": { "id": "", "type": [ "", ... "http://www.w3.org/ns/ldp#Resource" ] }, "published": "" } ```
FieldDescription
idString that contains an identifier for the event.
type

An array identifying the event type:

[
   "http://www.w3.org/ns/prov#Activity",
   "<Action>"
]

Where "<Action>" can be one of the following values:

  • "Create"
  • "Delete"
  • "Update"
objectThe resource object:
object.idString indicating the Resource URL.
object.type

An array indicating the Resource types.

Note

Because a Container object is also an RDF Resource, to determine if the object is a non-Container RDF Resource, check that neither http://www.w3.org/ns/ldp#Container nor http://www.w3.org/ns/ldp#BasicContainer appear as elements of object.type.

object.idString indicating the Resource URL.
object.type

An array indicating the Resource types.

Note

Because a Container object is also an RDF Resource, to determine if the object is a non-Container RDF Resource, check that neither http://www.w3.org/ns/ldp#Container nor http://www.w3.org/ns/ldp#BasicContainer appear as elements of object.type.

object.idString indicating the Resource URL.
object.type

An array indicating the Resource types.

Note

Because a Container object is also an RDF Resource, to determine if the object is a non-Container RDF Resource, check that neither http://www.w3.org/ns/ldp#Container nor http://www.w3.org/ns/ldp#BasicContainer appear as elements of object.type.

object.idString indicating the Resource URL.
object.type

An array indicating the Resource types.

Note

Because a Container object is also an RDF Resource, to determine if the object is a non-Container RDF Resource, check that neither http://www.w3.org/ns/ldp#Container nor http://www.w3.org/ns/ldp#BasicContainer appear as elements of object.type.

object.idString indicating the Resource URL.
object.type

An array indicating the Resource types.

Note

Because a Container object is also an RDF Resource, to determine if the object is a non-Container RDF Resource, check that neither http://www.w3.org/ns/ldp#Container nor http://www.w3.org/ns/ldp#BasicContainer appear as elements of object.type.

object.idString indicating the Resource URL.
object.type

An array indicating the Resource types.

Note

Because a Container object is also an RDF Resource, to determine if the object is a non-Container RDF Resource, check that neither http://www.w3.org/ns/ldp#Container nor http://www.w3.org/ns/ldp#BasicContainer appear as elements of object.type.

publishedThe date and time the event is published.
@contextAn array containing the JSON-LD contexts for the notification event itself.
## Configuration As part of the [installation process](https://docs.inrupt.com/ess/2.5/installation), Inrupt provides base Kustomize overlays and associated files that require deployment-specific configuration inputs. The following configuration options are available for the service and may be set as part of updating the inputs for your deployment. The Inrupt-provided base Kustomize overlays may be using updated configuration values that differ from the default values. ### Required #### INRUPT\_WEBSOCKET\_BASE\_URI The URI of the service; e.g., **`wss://websocket.example/`** #### QUARKUS\_GRPC\_CLIENTS\_AUTHZ\_HOST The host where the ESS Authorization Service is running. #### SMALLRYE\_JWT\_SIGN\_KEY\_LOCATION The path to the signing key used for negotiating subscriptions. ### Kafka Configuration {% hint style="info" %} **Tip** See also [ESS’ Kafka Configuration](https://docs.inrupt.com/ess/2.5/services/appendix/appendix-kafka-configuration) . {% endhint %} {% hint style="info" %} **Note**\ Whitespaces are **preserved** when parsing comma-delimited lists (i.e., the parsed string values are not trimmed). For example, when parsed, **`"value1, value2,value3 "`** results in **`"value1"`** , **`" value2"`** , **`"value3 "`** . {% endhint %} #### INRUPT\_KAFKA\_SOLIDRESOURCE\_CIPHER\_PASSWORD The symmetric key to use when decrypting messages (see [**`MP_MESSAGING_INCOMING_SOLIDRESOURCE_VALUE_DESERIALIZER`**](#mp_messaging_incoming_solidresource_value_deserializer)). {% hint style="warning" %} **Warning**\ Set to a strong password. {% endhint %} #### KAFKA\_BOOTSTRAP\_SERVERS Default: **`localhost:9092`** Comma-delimited list of Kafka broker servers for use by ESS services, including this service. Setting [**`KAFKA_BOOTSTRAP_SERVERS`**](#kafka_bootstrap_servers) configures ESS to use the same Kafka instance(s) for all its Kafka [message channels](https://quarkus.io/guides/kafka#kafka-configuration) (e.g., **`solidresource`** and **`auditv1out`** message channels). This service uses the **`solidresource`** and **`auditv1out`** channels. {% hint style="info" %} **Note** Inrupt-provided overlays default to using [**`KAFKA_BOOTSTRAP_SERVERS`**](#kafka_bootstrap_servers) . To use a different Kafka instance for the **`solidresource`** and **`auditv1out`** channels, use specific [message channel](https://quarkus.io/guides/kafka#kafka-configuration) configuration. {% endhint %} See also [ESS’ Kafka Configuration](https://docs.inrupt.com/ess/2.5/services/appendix/appendix-kafka-configuration) . #### MP\_MESSAGING\_INCOMING\_SOLIDRESOURCE\_SSL\_TRUSTSTORE\_LOCATION The location of the Kafka connection truststore #### MP\_MESSAGING\_INCOMING\_SOLIDRESOURCE\_SSL\_TRUSTSTORE\_PASSWORD The password for the Kafka connection truststore. #### MP\_MESSAGING\_INCOMING\_SOLIDRESOURCE\_VALUE\_DESERIALIZER Default: **`org.apache.kafka.common.serialization.StringDeserializer`** The deserializer to use to consume Kafka messages sent by the Pod services. Supported values are: * **`org.apache.kafka.common.serialization.StringDeserializer`** * Set to this value to consume notification messages sent by\ services that use **`org.apache.kafka.common.serialization.StringSerializer`** as\ their [**`MP_MESSAGING_OUTGOING_SOLIDRESOURCE_VALUE_SERIALIZER`**](#mp_messaging_incoming_solidresource_value_deserializer) * **`com.inrupt.components.kafka.encryption.DecryptMessageDeserializer`** * Set to this value to consume encrypted notification messages\ sent by services that use **`com.inrupt.components.kafka.encryption.EncryptMessageSerializer`**\ as their [**`MP_MESSAGING_OUTGOING_SOLIDRESOURCE_VALUE_SERIALIZER`**](#mp_messaging_incoming_solidresource_value_deserializer) #### MP\_MESSAGING\_OUTGOING\_AUDITV1OUT\_BOOTSTRAP\_SERVERS Default : **`localhost:9092`** Comma-delimited list of Kafka broker servers used for the outgoing audit v1 messages. These messages are sent over the **`auditv1out`** [message channel](https://quarkus.io/guides/kafka#kafka-configuration). {% hint style="info" %} **Note** To configure ESS to use the same Kafka instances for all its Kafka message channels, use [**`KAFKA_BOOTSTRAP_SERVERS`**](#kafka_bootstrap_servers) option instead. Inrupt-provided overlays default to using [**`KAFKA_BOOTSTRAP_SERVERS`**](#kafka_bootstrap_servers) . {% endhint %} ### Optional ### **Configuration Logging** ESS services log their startup configuration. #### INRUPT\_LOGGING\_CONFIGURATION\_PREFIX\_ALLOW Default : inrupt,smallrye.jwt.sign.key.location A comma-separated list of configuration property prefixes ( **case-sensitive** ) that determine which configurations are logged: * If the list is empty, **NO** configuration property is logged. * If a configuration property starts with a listed prefix ( **case-sensitive** ), the configuration property and its value are logged **unless** the configuration also matches a prefix in [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY`**](#inrupt_logging_configuration_prefix_deny) (which acts as a filter on [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW`**](#inrupt_logging_configuration_prefix_allow) list).\ As such, if the configuration matches prefix in both [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW`**](#inrupt_logging_configuration_prefix_allow) and [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY`**](#inrupt_logging_configuration_prefix_deny) , the [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY`**](#inrupt_logging_configuration_prefix_deny) takes precedence and the configuration is not logged. For example, if **`inrupt.`** is an allow prefix, but **`inrupt.kafka.`** is a deny prefix, all configurations that start with **`inrupt.kafka.`** are excluded from the logs. When specifying the prefixes, you can specify the prefixes using one of two formats: * using dot notation (e.g., **`inrupt.foobar.`** ), or * using the [MicroProfile Config environmental variables conversion value](https://quarkus.io/guides/config-reference#environment-variables) (e.g., **`INRUPT_FOOBAR_`** ). {% hint style="danger" %} **Warning**\ Use the same format for **both** [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW`**](#inrupt_logging_configuration_prefix_allow) and [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY`**](#inrupt_logging_configuration_prefix_deny) . For example, if you change the format of [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW`**](#inrupt_logging_configuration_prefix_allow) , change the format of [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY`**](#inrupt_logging_configuration_prefix_deny) as well. {% endhint %} {% hint style="info" %} **Tip** To avoid allowing more than desired configurations, specify as much of the prefix as possible. If the prefix specifies the complete prefix term, include the term delineator. For example: * If using dot-notation, if you want to match configuration properties of the form **`foobar....`** , specify **`foobar.`** (including the dot **`**.`** ) instead of, for example, **`foo`** or **`foobar`** . * If using converted form, if you want to match configuration properties of the form **`FOOBAR_...`** , specify **`FOOBAR_`** (including the underscore **`_`** ) instead of, for example, **`FOO`** or **`FOOBAR`** . {% endhint %} #### INRUPT\_LOGGING\_CONFIGURATION\_PREFIX\_DENY Default: inrupt.kafka A comma-separated list of configuration name prefixes ( **case-sensitive** ) that determines which configurations (that would otherwise match the [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW`**](#inrupt_logging_configuration_prefix_allow) ) are not logged. That is, [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY`**](#inrupt_logging_configuration_prefix_deny) acts as a filter on [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW`**](#inrupt_logging_configuration_prefix_allow) . For example: * If **`foobar.`** is an allowed prefix, to suppress **`foobar.private.`** , you can specify **`foobar.private.`** to the deny list. * If **`foobar.`** is **not** an allowed prefix, no property starting with **`foobar.`** is logged. As such, you do not need to specify **`foobar.private`** to the deny list. When specifying the prefixes, you can specify the prefixes using one of two formats: * using dot notation (e.g., **`inrupt.foobar.`** ), or * using the [MicroProfile Config environmental variables conversion value](https://quarkus.io/guides/config-reference#environment-variables) (e.g., **`INRUPT_FOOBAR_`** ). {% hint style="danger" %} **Warning**\ Use the same format for **both** [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW`**](#inrupt_logging_configuration_prefix_allow) and [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY`**](#inrupt_logging_configuration_prefix_deny) . For example, if you change the format of [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW`**](#inrupt_logging_configuration_prefix_allow) , change the format of [**`INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY`**](#inrupt_logging_configuration_prefix_deny) as well. {% endhint %} ### **Logging Redaction** #### INRUPT\_LOGGING\_REDACTION\_{NAME}\_ACTION Default : **`REPLACE`** Type of the redaction to perform. Supported values are:
ActionDescription
REPLACEDefault. Replaces the matching text with a specified replacement.
PLAINLeaves the matching field unprocessed. Only available if the redaction target is a field (i.e., INRUPT_LOGGING_REDACTION_{NAME}_FIELD).
DROPSuppresses the matching field. Only available if the redaction target is a field (i.e., INRUPT_LOGGING_REDACTION_{NAME}_FIELD).
PRIORITIZEChanges the log level of the matching message.
SHA256Replaces the matching text with its hash.
* If the action is **`REPLACE`** ( *default* ), see also **`INRUPT_LOGGING_REDACTION_{NAME}_REPLACEMENT`** . * If the action is to **`PRIORITIZE`** , see also **`INRUPT_LOGGING_REDACTION_{NAME}_LEVEL`** . For more information on log redaction, see [Logging Redaction](https://docs.inrupt.com/ess/2.5/administration/logging/logging-redaction). #### INRUPT\_LOGGING\_REDACTION\_{NAME}\_ENABLED Default : **`true`** A boolean that determines whether the redaction configurations with the specified **`INRUPT_LOGGING_REDACTION_{NAME}_`** prefix is enabled. For more information on log redaction, see [Logging Redaction](https://docs.inrupt.com/ess/2.5/administration/logging/logging-redaction). #### INRUPT\_LOGGING\_REDACTION\_{NAME}\_EXCEPTION Fully qualified name of the exception class to match in the log messages (includes inner exception). Configure to target an exception message class. For more information on log redaction, see [Logging Redaction](https://docs.inrupt.com/ess/2.5/administration/logging/logging-redaction). #### INRUPT\_LOGGING\_REDACTION\_{NAME}\_FIELD Exact name of the field to match in the log messages. Configure to target a specific log message field for redaction. For more information on log redaction, see [Logging Redaction](https://docs.inrupt.com/ess/2.5/administration/logging/logging-redaction). #### INRUPT\_LOGGING\_REDACTION\_{NAME}\_LEVEL Default : **`DEBUG`** A new log level to use for the log message if the **`INRUPT_LOGGING_REDACTION_{NAME}_ACTION`** is **`PRIORITIZE`** . #### INRUPT\_LOGGING\_REDACTION\_{NAME}\_PATTERN A regex (see [Java regex pattern](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/regex/Pattern.html#sum) ) to match in the log messages. Configure to target log message text that matches a specified pattern. For more information on log redaction, see [Logging Redaction](https://docs.inrupt.com/ess/2.5/administration/logging/logging-redaction). #### INRUPT\_LOGGING\_REDACTION\_{NAME}\_REPLACEMENT Default : **`[REDACTED]`** Replacement text to use if the **`INRUPT_LOGGING_REDACTION_{NAME}_ACTION`** is **`REPLACE`**. If unspecified, defaults to **`[REDACTED]`** . For more information on log redaction, see [Logging Redaction](https://docs.inrupt.com/ess/2.5/administration/logging/logging-redaction). ### **Application-Defined Metadata Propagation** #### INRUPT\_AUDIT\_PRODUCER\_REQUEST\_METADATA\_ALLOW A comma-separated list of application-defined properties that can be included in the associated [audit events](https://github.com/inrupt/docs-gitbook/blob/main/ess/security/auditing/README.md#audit-event-message-internal-format) (unless specified in the corresponding [**`INRUPT_AUDIT_PRODUCER_REQUEST_METADATA_DENY`**](#inrupt_audit_producer_request_metadata_deny) ). This configuration is **case-sensitive** to the propagated properties in the baggage. {% hint style="info" %} **Tip** To include a propagated property that was added via the [**`INRUPT_REQUEST_METADATA_PROPAGATOR_HEADER_ALLOW`**](#inrupt_request_metadata_propagator_header_allow) configuration, ensure that the cases of these properties match. {% endhint %} See: * [Manage Application-Defined Metadata Propagation](https://docs.inrupt.com/ess/2.5/installation/customize-configurations/customization-logging/manage-app-defined-metadata) to configure. * [Application-Defined Metadata](https://docs.inrupt.com/ess/2.5/administration/application-defined-metadata) for more information. #### INRUPT\_AUDIT\_PRODUCER\_REQUEST\_METADATA\_DENY A comma-separated list of application-defined properties to exclude from the associated audit messages. This setting takes precedence over [**`INRUPT_AUDIT_PRODUCER_REQUEST_METADATA_ALLOW`**](#inrupt_audit_producer_request_metadata_allow) . This configuration is **case-sensitive** to the propagated properties in the baggage. {% hint style="info" %} **Tip** To exclude a propagated property that was added via the [**`INRUPT_REQUEST_METADATA_PROPAGATOR_HEADER_ALLOW`**](#inrupt_request_metadata_propagator_header_allow) configuration, ensure that the cases of these properties match. {% endhint %} See: * [Manage Application-Defined Metadata Propagation](https://docs.inrupt.com/ess/2.5/installation/customize-configurations/customization-logging/manage-app-defined-metadata) to configure. * [Application-Defined Metadata](https://docs.inrupt.com/ess/2.5/administration/application-defined-metadata) for more information. #### INRUPT\_LOGGING\_REQUEST\_METADATA\_ALLOW A comma-separated list of application-defined properties that can be included in the associated [log messages](https://github.com/inrupt/docs-gitbook/blob/main/enterprise-solid-server/2.5/security/auditing/README.md#audit-event-message-internal-format\)) (unless specified in the corresponding [**`INRUPT_LOGGING_REQUEST_METADATA_DENY`**](#inrupt_logging_request_metadata_deny) ). This configuration is **case-sensitive** to the propagated properties in the baggage. {% hint style="info" %} **Tip** To include a propagated property that was added via the [**`INRUPT_REQUEST_METADATA_PROPAGATOR_HEADER_ALLOW`**](#inrupt_request_metadata_propagator_header_allow) configuration, ensure that the cases of these properties match. {% endhint %} See: * [Manage Application-Defined Metadata Propagation](https://docs.inrupt.com/ess/2.5/installation/customize-configurations/customization-logging/manage-app-defined-metadata) to configure. * [Application-Defined Metadata](https://docs.inrupt.com/ess/2.5/administration/application-defined-metadata) for more information. #### INRUPT\_LOGGING\_REQUEST\_METADATA\_DENY A comma-separated list of application-defined properties to exclude from the associated log messages. This setting takes precedence over [**`INRUPT_LOGGING_REQUEST_METADATA_ALLOW`**](#inrupt_logging_request_metadata_allow) . This configuration is **case-sensitive** to the propagated properties in the baggage. {% hint style="info" %} **Tip** To exclude a propagated property that was added via the [**`INRUPT_REQUEST_METADATA_PROPAGATOR_HEADER_ALLOW`**](#inrupt_request_metadata_propagator_header_allow) configuration, ensure that the cases of these properties match. {% endhint %} See: * [Manage Application-Defined Metadata Propagation](https://docs.inrupt.com/ess/2.5/installation/customize-configurations/customization-logging/manage-app-defined-metadata) to configure. * [Application-Defined Metadata](https://docs.inrupt.com/ess/2.5/administration/application-defined-metadata) for more information. #### INRUPT\_REQUEST\_METADATA\_PROPAGATOR\_HEADER\_ALLOW A comma-separated list of non-baggage request headers to add to the [baggage](https://www.w3.org/TR/baggage/) (unless specified in the corresponding [**`INRUPT_REQUEST_METADATA_PROPAGATOR_HEADER_DENY`**](#inrupt_request_metadata_propagator_header_deny) ); i.e., include these non-baggage request headers as application-defined properties. The configuration is case-insensitive; i.e., the listed headers do **not** need to match the case of the client request headers. For example, a list that includes **`x-correlation-id`** can match **`x-correlation-id`** header, **`X-CoRrElAtIoN-Id`** header, etc. See: * [Manage Application-Defined Metadata Propagation](https://docs.inrupt.com/ess/2.5/installation/customize-configurations/customization-logging/manage-app-defined-metadata) to configure. * [Application-Defined Metadata](https://docs.inrupt.com/ess/2.5/administration/application-defined-metadata) for more information. #### INRUPT\_REQUEST\_METADATA\_PROPAGATOR\_HEADER\_DENY A comma-separated list of non-baggage request headers to exclude from being added to the [baggage](https://www.w3.org/TR/baggage/) ; i.e., excludes these headers as application-defined properties. This setting takes precedence over [**`INRUPT_REQUEST_METADATA_PROPAGATOR_HEADER_ALLOW`**](#inrupt_request_metadata_propagator_header_allow) . The configuration is case-insensitive; i.e., the listed headers do **not** need to match the case of the client request headers. For example, a list that includes **`x-correlation-id`** can match (and exclude) **`x-correlation-id`** header, **`X-CoRrElAtIoN-Id`** header, etc. See: * [Manage Application-Defined Metadata Propagation](https://docs.inrupt.com/ess/2.5/installation/customize-configurations/customization-logging/manage-app-defined-metadata) to configure. * [Application-Defined Metadata](https://docs.inrupt.com/ess/2.5/administration/application-defined-metadata) for more information. #### INRUPT\_REQUEST\_METADATA\_PROPAGATOR\_HEADER\_OVERRIDES A flag that determines ESS behavior when metadata property is defined both as a header and as a baggage entry: * If **`true`** ESS updates/overrides the baggage entry with the header value. * If **`false`** (the default), ESS keeps the baggage entry. For details, [Duplicate Property Definition](https://docs.inrupt.com/ess/administration/application-defined-metadata#duplicate-property-definition) #### INRUPT\_REQUEST\_METADATA\_REFLECTOR\_HEADER\_ALLOW A comma-separated list of application-defined properties that can return as response headers (unless specified in the corresponding [**`INRUPT_REQUEST_METADATA_REFLECTOR_HEADER_DENY`**](#inrupt_request_metadata_reflector_header_deny) ). This configuration is **case-sensitive** to the propagated properties in the baggage. {% hint style="info" %} Tip * To return a propagated property that was added via the [**`INRUPT_REQUEST_METADATA_PROPAGATOR_HEADER_ALLOW`**](#inrupt_request_metadata_propagator_header_allow) configuration, ensure that the cases of these properties match. * You may need to update **`QUARKUS_HTTP_CORS_EXPOSED_HEADERS`** to extend the list of [CORS-safelisted response headers](https://developer.mozilla.org/en-US/docs/Glossary/CORS-safelisted_response_header) . {% endhint %} See: * [Manage Application-Defined Metadata Propagation](https://docs.inrupt.com/ess/2.5/installation/customize-configurations/customization-logging/manage-app-defined-metadata) to configure. * [Application-Defined Metadata](https://docs.inrupt.com/ess/2.5/administration/application-defined-metadata) for more information. #### INRUPT\_REQUEST\_METADATA\_REFLECTOR\_HEADER\_DENY A comma-separated list of application-defined properties to exclude from returning as response headers. This setting takes precedence over [**`INRUPT_REQUEST_METADATA_REFLECTOR_HEADER_ALLOW`**](#inrupt_request_metadata_reflector_header_allow) . This configuration is **case-sensitive** to the propagated properties in the baggage. {% hint style="info" %} **Tip** To exclude a propagated property that was added via the [**`INRUPT_REQUEST_METADATA_PROPAGATOR_HEADER_ALLOW`**](#inrupt_request_metadata_propagator_header_allow) configuration, ensure that the cases of these properties match. {% endhint %} See: * [Manage Application-Defined Metadata Propagation](https://docs.inrupt.com/ess/2.5/installation/customize-configurations/customization-logging/manage-app-defined-metadata) to configure. * [Application-Defined Metadata](https://docs.inrupt.com/ess/2.5/administration/application-defined-metadata) for more information. ### **General** #### INRUPT\_JWT\_ALLOWED\_SIGNATURE\_ALGORITHMS Default: **`ES256, RS256`** A comma-separated list that specifies the allowed encryption algorithms used to sign ID tokens. #### INRUPT\_JWT\_ISSUER\_ALLOW\_LIST A comma-separated list of trusted Solid-OIDC issuers (i.e., identity providers). * If unset, the service accepts all Solid-OIDC issuers with the exception of those in the [**`INRUPT_JWT_ISSUER_DENY_LIST`**](#inrupt_jwt_issuer_deny_list). * If set, the service accepts only those Solid-OIDC issuers in the list with the following exception: * If an issuer is in both [**`INRUPT_JWT_ISSUER_ALLOW_LIST`**](#inrupt_jwt_issuer_allow_list) and [**`INRUPT_JWT_ISSUER_DENY_LIST`**](#inrupt_jwt_issuer_deny_list), the [**`INRUPT_JWT_ISSUER_DENY_LIST`**](#inrupt_jwt_issuer_deny_list) supersedes the [**`INRUPT_JWT_ISSUER_ALLOW_LIST`**](#inrupt_jwt_issuer_allow_list) and the issuer is not accepted by ESS. See also [**`INRUPT_JWT_ISSUER_DENY_LIST`**](#inrupt_jwt_issuer_deny_list). #### INRUPT\_JWT\_ISSUER\_DENY\_LIST A comma-separated list of disallowed Solid-OIDC issuers. * If unset, the service accepts all Solid-OIDC issuers unless [**`INRUPT_JWT_ISSUER_ALLOW_LIST`**](#inrupt_jwt_issuer_allow_list) is set, in which case, the service only accepts those in the [**`INRUPT_JWT_ISSUER_ALLOW_LIST`**](#inrupt_jwt_issuer_allow_list) . * If set, the service disallows the Solid-OIDC issuers in the list. If [**`INRUPT_JWT_ISSUER_ALLOW_LIST`**](#inrupt_jwt_issuer_allow_list) is also set, issuers not in the [**`INRUPT_JWT_ISSUER_ALLOW_LIST`**](#inrupt_jwt_issuer_allow_list) are also disallowed. #### QUARKUS\_LOG\_LEVEL Default: **`INFO`** Logging level. ## Additional Information See also [Quarkus Configuration Options](https://quarkus.io/guides/all-config)