# Installation/Configuration

RESTEasy is installed and configured in different ways depending on which environment you are running in. If you are running in WildFly, RESTEasy is already bundled and integrated completely so there is very little you have to do. If you are running in a different environment, there is some manual installation and configuration you will have to do.

## RESTEasy modules in WildFly

In WildFly, RESTEasy and the JAX-RS API are automatically loaded into your deployment's classpath if and only if you are deploying a JAX-RS application (as determined by the presence of JAX-RS annotations). However, only some RESTEasy features are automatically loaded. See Table 3.1. If you need any of those libraries which are not loaded automatically, you'll have to bring them in with a jboss-deployment-structure.xml file in the WEB-INF directory of your WAR file. Here's an example:

    <jboss-deployment-structure>
        <deployment>
            <dependencies>
                <module name="org.jboss.resteasy.resteasy-jackson-provider" services="import"/>
            </dependencies>
        </deployment>
    </jboss-deployment-structure>

The `services` attribute must be set to "import" for modules that have default providers in a META-INF/services/javax.ws.rs.ext.Providers file.

To get an idea of which RESTEasy modules are loaded by default when JAX-RS services are deployed, please see the table below, which refers to a recent WildFly ditribution patched with the current RESTEasy distribution. Clearly, future and unpatched WildFly distributions might differ a bit in terms of modules enabled by default, as the container actually controls this too.

Module Name | Loaded by Default | Description
org.jboss.resteasy.resteasy-atom-provider | yes | RESTEasy's atom library
org.jboss.resteasy.resteasy-cdi | yes | RESTEasy CDI integration
org.jboss.resteasy.resteasy-crypto | yes | S/MIME, DKIM, and support for other security formats.
org.jboss.resteasy.resteasy-jackson-provider | no | Integration with the JSON parser and object mapper Jackson (deprecated)
org.jboss.resteasy.resteasy-jackson2-provider | yes | Integration with the JSON parser and object mapper Jackson 2
org.jboss.resteasy.resteasy-jaxb-provider | yes | XML JAXB integration.
org.jboss.resteasy.resteasy-jaxrs | yes | Core RESTEasy libraries for server and client. You will need to include this in your deployment if you are only using JAX-RS client.
org.jboss.resteasy.resteasy-jettison-provider | no | Alternative JAXB-like parser for JSON (deprecated)
org.jboss.resteasy.jose-jwt | no | JSON Web Token support.
org.jboss.resteasy.resteasy-jsapi | yes | RESTEasy's Javascript API
org.jboss.resteasy.resteasy-json-p-provider | yes | JSON parsing API
org.jboss.resteasy.resteasy-json-binding-provider | yes | JSON binding API
javax.json.bind-api | yes | JSON binding API
org.eclipse.yasson | yes | RI implementation of JSON binding API
org.jboss.resteasy.resteasy-multipart-provider | yes | Support for multipart formats
org.jboss.resteasy.skeleton-key | no | OAuth2 support.
org.jboss.resteasy.resteasy-spring | no | Spring provider
org.jboss.resteasy.resteasy-validator-provider-11 | yes | RESTEasy's interface to Hibernate Bean Validation 1.1
org.jboss.resteasy.resteasy-yaml-provider | yes | YAML marshalling

### Other RESTEasy modules

Not all RESTEasy modules are bundled with WildFly. For example, resteasy-fastinfoset-provider and resteasy-wadl are not included among the modules listed in resteasy_modules_in_wildfly. If you want to use them in your application, you can include them in your WAR as you would if you were deploying outside of WildFly. See standalone_resteasy for more information.

### Upgrading RESTEasy within WildFly

RESTEasy is bundled with WildFly, but you may want to upgrade RESTEasy in WildFly to the latest version. The RESTEasy distribution comes with a zip file called resteasy-jboss-modules-<version>.zip. Unzip this file within the modules/system/layers/base/ directory of the WildFly distribution. This will configure WildFly to use new versions of the modules listed in resteasy_modules_in_wildfly.

## Deploying a RESTEasy application to WildFly

RESTEasy is bundled with WildFly and completely integrated as per the requirements of Java EE. You can use it with EJB and CDI and you can rely completely on WildFly to scan for and deploy your JAX-RS services and providers. All you have to provide is your JAX-RS service and provider classes packaged within a WAR either as POJOs, CDI beans, or EJBs. A simple way to configure an application is by simply providing an empty web.xml file. You can of course deploy any custom servlet, filter or security constraint you want to within your web.xml, but none of them are required:

    <web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
    </web-app>

Also, RESTEasy context-params (see configuration_switches) are available if you want to tweak or turn on/off any specific RESTEasy feature.

Since we're not using a <servlet-mapping> element, we must define a `javax.ws.rs.core.Application` class (see javax.ws.rs.core.Application) that is annotated with the `javax.ws.rs.ApplicationPath` annotation. If you return any empty set for classes and singletons, which is the behavior inherited from `Application`, your WAR will be scanned for resource and provider classes as indicated by the presence of JAX-RS annotations.

    import javax.ws.rs.ApplicationPath;
    import javax.ws.rs.core.Application;

    @ApplicationPath("/root-path")
    public class MyApplication extends Application
    {
    }

Note. Actually, if the application jar contains an `Application` class (or a subclass thereof) which is annotated with an `ApplicationPath` annotation, a web.xml file isn't even needed. Of course, even in this case it can be used to specify additional information such as context parameters. If there is an `Application` class but it doesn't have an `@ApplicationPath` annotation, then a web.xml file with at least a <servlet-mapping> element is required.

Note. As mentioned in other_resteasy_modules, not all RESTEasy modules are bundled with WildFly. For example, resteasy-fastinfoset-provider and resteasy-wadl are not included among the modules listed in resteasy_modules_in_wildfly. If you want to use them in your application, you can include them in your WAR as you would if you were deploying outside of WildFly. See standalone_resteasy for more information.

## Deploying to other servlet containers

If you are using RESTEasy outside of WildFly, in a standalone servlet container like Tomcat or Jetty, for example, you will need to include the appropriate RESTEasy jars in your WAR file. You will need the core classes in the resteasy-jaxrs module, and you may need additional facilities like the resteasy-jaxb-provider module. We strongly suggest that you use Maven to build your WAR files as RESTEasy is split into a bunch of different modules:

    <dependency>
        <groupId>org.jboss.resteasy</groupId>
        <artifactId>resteasy-jaxrs</artifactId>
        <version>${resteasy.version}</version>
    </dependency>
    <dependency>
        <groupId>org.jboss.resteasy</groupId>
        <artifactId>resteasy-jaxb-provider</artifactId>
        <version>${resteasy.version}</version>
    </dependency>

You can see sample Maven projects in https://github.com/resteasy/resteasy-examples.

If you are not using Maven, you can include the necessary jars by hand. If you download RESTEasy (from http://resteasy.jboss.org/downloads.html, for example) you will get a file like resteasy-jaxrs-<version>-all.zip. If you unzip it you will see a lib/ directory that contains the libraries needed by RESTEasy. Copy these, as needed, into your /WEB-INF/lib directory. Place your JAX-RS annotated class resources and providers within one or more jars within /WEB-INF/lib or your raw class files within /WEB-INF/classes.

### Servlet 3.0 containers

RESTEasy uses the `ServletContainerInitializer` integration interface in Servlet 3.0 containers to initialize an application, automatically scanning for resources and providers. To enable automatic scanning, you must also include the `resteasy-servlet-initializer` artifact in your WAR file as well:

    <dependency>
        <groupId>org.jboss.resteasy</groupId>
        <artifactId>resteasy-servlet-initializer</artifactId>
        <version>${resteasy.version}</version>
    </dependency>

### Older servlet containers

The `resteasy-servlet-initializer` artifact will not work in Servlet versions older than 3.0. You'll then have to manually declare the RESTEasy servlet in your WEB-INF/web.xml file of your WAR project, and you'll have to use an `Application` class (see javax.ws.rs.core.Application) which explicitly lists resources and providers. For example:

    <web-app>
        <display-name>Archetype Created Web Application</display-name>

        <servlet>
            <servlet-name>Resteasy</servlet-name>
            <servlet-class>
                org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher
            </servlet-class>
            <init-param>
                <param-name>javax.ws.rs.Application</param-name>
                <param-value>com.restfully.shop.services.ShoppingApplication</param-value>
            </init-param>
        </servlet>

        <servlet-mapping>
            <servlet-name>Resteasy</servlet-name>
            <url-pattern>/*</url-pattern>
        </servlet-mapping>

    </web-app>

The RESTEasy servlet is responsible for initializing some basic components of RESTEasy.

Note. It is likely that support for pre-3.0 Servlet specifications will be deprecated and eliminated eventually.

## Configuration switches

RESTEasy receives configuration options from <context-param> elements.

Option Name | Default Value | Description
resteasy.servlet.mapping.prefix | no default | If the url-pattern for the RESTEasy servlet-mapping is not /*
resteasy.scan | false | Automatically scan WEB-INF/lib jars and WEB-INF/classes directory for both @Provider and JAX-RS resource classes (@Path, @GET, @POST etc..) and register them. This property is deprecated; please use a Servlet 3.0 container or higher and the ResteasyServletInitializer instead.
resteasy.scan.providers | false | Scan for @Provider classes and register them. This property is deprecated; please use a Servlet 3.0 container or higher and the ResteasyServletInitializer instead.
resteasy.scan.resources | false | Scan for JAX-RS resource classes. This property is deprecated; please use a Servlet 3.0 container or higher and the ResteasyServletInitializer instead.
resteasy.providers | no default | A comma delimited list of fully qualified @Provider class names you want to register
resteasy.use.builtin.providers | true | Whether or not to register default, built-in @Provider classes
resteasy.resources | no default | A comma delimited list of fully qualified JAX-RS resource class names you want to register
resteasy.jndi.resources | no default | A comma delimited list of JNDI names which reference objects you want to register as JAX-RS resources
javax.ws.rs.Application | no default | Fully qualified name of Application class to bootstrap in a spec portable way
resteasy.media.type.mappings | no default | Replaces the need for an Accept header by mapping file name extensions (like .xml or .txt) to a media type. Used when the client is unable to use an Accept header to choose a representation (i.e. a browser). See JAX-RS_Content_Negotiation for more details.
resteasy.language.mappings | no default | Replaces the need for an Accept-Language header by mapping file name extensions (like .en or .fr) to a language. Used when the client is unable to use an Accept-Language header to choose a language (i.e. a browser). See JAX-RS_Content_Negotiation for more details.
resteasy.media.type.param.mapping | no default | Names a query parameter that can be set to an acceptable media type, enabling content negotiation without an Accept header. See JAX-RS_Content_Negotiation for more details.
resteasy.role.based.security | false | Enables role based security. See Securing_JAX-RS_and_RESTeasy for more details.
resteasy.document.expand.entity.references | false | Expand external entities in org.w3c.dom.Document documents and JAXB object representations
resteasy.document.secure.processing.feature | true | Impose security constraints in processing org.w3c.dom.Document documents and JAXB object representations
resteasy.document.secure.disableDTDs | true | Prohibit DTDs in org.w3c.dom.Document documents and JAXB object representations
resteasy.wider.request.matching | false | Turns off the JAX-RS spec defined class-level expression filtering and instead tries to match version every method's full path.
resteasy.use.container.form.params | false | Obtain form parameters by using HttpServletRequest.getParameterMap(). Use this switch if you are calling this method within a servlet filter or eating the input stream within the filter.
resteasy.rfc7232preconditions | false | Enables RFC7232 compliant HTTP preconditions handling.
resteasy.gzip.max.input | 10000000 | Imposes maximum size on decompressed gzipped .
resteasy.secure.random.max.use | 100 | The number of times a SecureRandom can be used before reseeding.
resteasy.buffer.exception.entity | true | Upon receiving an exception, the client side buffers any response entity before closing the connection.
resteasy.add.charset | true | If a resource method returns a text/* or application/xml* media type without an explicit charset, RESTEasy will add "charset=UTF-8" to the returned Content-Type header. Note that the charset defaults to UTF-8 in this case, independent of the setting of this parameter.
jaxrs.2.0.request.matching | false | In searching for a matching resource method with which to respond to a request, consider only resource methods with the best match for the request path. See JAX-RS 2.0 Matching Algorithm for discussion.
resteasy.disable.html.sanitizer | false | Normally, a response with media type "text/html" and a status of 400 will be processed so that the characters "/", "<", ">", "&", """ (double quote), and "'" (single quote) are escaped to prevent an XSS attack. If this parameter is set to "true", escaping will not occur.

Note. The resteasy.servlet.mapping.prefix <context param> variable must be set if your servlet-mapping for the RESTEasy servlet has a url-pattern other than /*. For example, if the url-pattern is

    <servlet-mapping>
    <servlet-name>Resteasy</servlet-name>
    <url-pattern>/restful-services/*</url-pattern>
    </servlet-mapping>

Then the value of resteasy.servlet.mapping.prefix must be:

    <context-param>
    <param-name>resteasy.servlet.mapping.prefix</param-name>
    <param-value>/restful-services</param-value>
    </context-param>

## javax.ws.rs.core.Application

The `javax.ws.rs.core.Application` class is a standard JAX-RS class that you may implement to provide information on your deployment. It is simply a class the lists all JAX-RS root resources and providers.

    /**
    * Defines the components of a JAX-RS application and supplies additional
    * metadata. A JAX-RS application or implementation supplies a concrete
    * subclass of this abstract class.
    */
    public abstract class Application
    {
        private static final Set<Object> emptySet = Collections.emptySet();

        /**
        * Get a set of root resource and provider classes. The default lifecycle
        * for resource class instances is per-request. The default lifecycle for
        * providers is singleton.
        * <p/>
        * <p>Implementations should warn about and ignore classes that do not
        * conform to the requirements of root resource or provider classes.
        * Implementations should warn about and ignore classes for which
        * {@link #getSingletons()} returns an instance. Implementations MUST
        * NOT modify the returned set.</p>
        *
        * @return a set of root resource and provider classes. Returning null
        * is equivalent to returning an empty set.
        */
        public abstract Set<Class<?>> getClasses();

        /**
        * Get a set of root resource and provider instances. Fields and properties
        * of returned instances are injected with their declared dependencies
        * (see {@link Context}) by the runtime prior to use.
        * <p/>
        * <p>Implementations should warn about and ignore classes that do not
        * conform to the requirements of root resource or provider classes.
        * Implementations should flag an error if the returned set includes
        * more than one instance of the same class. Implementations MUST
        * NOT modify the returned set.</p>
        * <p/>
        * <p>The default implementation returns an empty set.</p>
        *
        * @return a set of root resource and provider instances. Returning null
        * is equivalent to returning an empty set.
        */
        public Set<Object> getSingletons()
        {
            return emptySet;
        }

    }

Note. If your web.xml file does not have a <servlet-mapping> element, you must use an `Application` class annotated with `@ApplicationPath`.

## RESTEasy as a ServletContextListener

This section is pretty much deprecated if you are using a Servlet 3.0 container or higher. Skip it if you are and read the configuration section above on installing in Servlet 3.0. The initialization of RESTEasy can be performed within a ServletContextListener instead of within the Servlet. You may need this if you are writing custom Listeners that need to interact with RESTEasy at boot time. An example of this is the RESTEasy Spring integration that requires a Spring ServletContextListener. The org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap class is a ServletContextListener that configures an instance of an ResteasyProviderFactory and Registry. You can obtain instances of a ResteasyProviderFactory and Registry from the ServletContext attributes org.jboss.resteasy.spi.ResteasyProviderFactory and org.jboss.resteasy.spi.Registry. From these instances you can programmatically interact with RESTEasy registration interfaces.

    <web-app>
       <listener>
          <listener-class>
             org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap
          </listener-class>
       </listener>

      <!-- ** INSERT YOUR LISTENERS HERE!!!! -->

       <servlet>
          <servlet-name>Resteasy</servlet-name>
          <servlet-class>
             org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher
          </servlet-class>
       </servlet>

       <servlet-mapping>
          <servlet-name>Resteasy</servlet-name>
          <url-pattern>/Resteasy/*</url-pattern>
       </servlet-mapping>

    </web-app>

## RESTEasy as a Servlet Filter

This section is pretty much deprecated if you are using a Servlet 3.0 container or higher. Skip it if you are and read the configuration section above on installing in Servlet 3.0. The downside of running RESTEasy as a Servlet is that you cannot have static resources like .html and .jpeg files in the same path as your JAX-RS services. RESTEasy allows you to run as a Filter instead. If a JAX-RS resource is not found under the URL requested, RESTEasy will delegate back to the base servlet container to resolve URLs.

    <web-app>
        <filter>
            <filter-name>Resteasy</filter-name>
            <filter-class>
                org.jboss.resteasy.plugins.server.servlet.FilterDispatcher
            </filter-class>
            <init-param>
                <param-name>javax.ws.rs.Application</param-name>
                <param-value>com.restfully.shop.services.ShoppingApplication</param-value>
            </init-param>
        </filter>

        <filter-mapping>
            <filter-name>Resteasy</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

    </web-app>

## Client side

JAX-RS 2.0 conforming implementations such as RESTEasy support a client side framework which simplifies communicating with restful applications. In RESTEasy, the minimal set of modules needed for the client framework consists of resteasy-jaxrs and resteasy-client. You can access them by way of maven:

    <dependency>
        <groupId>org.jboss.resteasy</groupId>
        <artifactId>resteasy-jaxrs</artifactId>
        <version>${resteasy.version}</version>
    </dependency>
    <dependency>
        <groupId>org.jboss.resteasy</groupId>
        <artifactId>resteasy-client</artifactId>
        <version>${resteasy.version}</version>
    </dependency>

Other modules, such as resteasy-jaxb-provider, may be brought in as needed.