@Override
protected boolean confidentialityRequired(HttpServerExchange exchange) {
final ServletRequestContext servletRequestContext = exchange.getAttachment(ServletRequestContext.ATTACHMENT_KEY);
//the configure (via web.xml or annotations) guarantee
TransportGuaranteeType configuredGuarantee = servletRequestContext.getTransportGuarenteeType();
Deployment deployment = servletRequestContext.getDeployment();
final AuthorizationManager authorizationManager = deployment.getDeploymentInfo().getAuthorizationManager();
TransportGuaranteeType connectionGuarantee = servletRequestContext.getOriginalRequest().isSecure() ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE;
TransportGuaranteeType transportGuarantee = authorizationManager.transportGuarantee(connectionGuarantee, configuredGuarantee, servletRequestContext.getOriginalRequest());
// TODO - We may be able to add more flexibility here especially with authentication mechanisms such as Digest for
// INTEGRAL - for now just use SSL.
return (TransportGuaranteeType.CONFIDENTIAL == transportGuarantee || TransportGuaranteeType.INTEGRAL == transportGuarantee);
}