@Override
    public ContentChannel handleRequest(Request req, ResponseHandler responseHandler) {
        var capabilityRequiringHandler =
                DelegatedRequestHandler.resolve(CapabilityRequiringRequestHandler.class, wrapped).orElse(null);
        var requiredCapabilities = capabilityRequiringHandler != null
                ? capabilityRequiringHandler.requiredCapabilities(new View(req))
                : CapabilityRequiringRequestHandler.DEFAULT_REQUIRED_CAPABILITY.toCapabilitySet();
        var authCtx = Optional.ofNullable(req.context().get(RequestUtils.JDISC_REQUEST_SSLSESSION))
                .flatMap(s -> TransportSecurityUtils.getConnectionAuthContext((SSLSession) s))
                .orElse(null);

        // Connection auth context will not be available if handler is bound to:
        // 1) server with custom TLS configuration.
        // 2) server without TLS (http)
        if (authCtx != null) {
            var peer = Optional.ofNullable(((HttpRequest)req).getRemoteAddress())
                    .map(Object::toString).orElse("<unknown>");
            String method = ((HttpRequest) req).getMethod().name();
            try {
                authCtx.verifyCapabilities(requiredCapabilities, method, req.getUri().getPath(), peer);
            } catch (MissingCapabilitiesException e) {
                int code = HttpResponse.Status.FORBIDDEN;
                var resp = new Response(code);
                resp.headers().add("Content-Type", "application/json");
                ContentChannel ch = responseHandler.handleResponse(resp);
                var slime = new Slime();
                var root = slime.setObject();
                root.setString("error-code", Integer.toString(code));
                root.setString("message", "Missing required capabilities");
                ch.write(ByteBuffer.wrap(uncheck(() -> SlimeUtils.toJsonBytes(slime))), null);
                ch.close(null);
                return null;
            }
        }
        return wrapped.handleRequest(req, responseHandler);
    }
Request handler wrapper that enforces required capabilities as specified by underlying {@link CapabilityRequiringRequestHandler}.

@author bjorncs
container-core/src/main/java/com/yahoo/jdisc/http/server/jetty/CapabilityEnforcingRequestHandler.java