Web Application Development 1. Outline Web application architecture HTTP CGI Java Servlets Apache...

Web Application Development

Outline

• Web application architecture

• HTTP

• CGI

• Java Servlets

• Apache Tomcat

• Session maintenance

Architecture

• Created by Tim Berners-Lee at CERN– Defined 1989-1991

• Standardized and much expanded by the IETF• Rides on top of TCP protocol

– TCP provides: reliable, bi-directional, in-order byte stream• Goal: transfer objects between systems

– Do not confuse with other WWW concepts:• HTTP is not page layout language (that is HTML)• HTTP is not object naming scheme (that is URLs)

• Text-based protocol– Human readable

Client-Server Paradigm

Client: initiates contact with server

(“speaks first”) typically requests service from

server, for Web, client is implemented

in browser; for e-mail, in mail reader

Server: provides requested service to

client e.g., Web server sends

requested Web page, mail server delivers e-mail

PC runningExplorer

Apache Webserver

Mac runningSafari

HTTP requestHTTP response

http re

sponse

HTTP Request Message Format

HTTP method URL sp HTTP version cr lf

header field name : field value cr lf

request linesp

Entity Body

header lines

HTTP Request Example

GET /somedir/page.html HTTP/1.0 User-agent: Mozilla/4.0 Accept: text/html, image/gif,image/jpeg Accept-language:fr

(extra carriage return, line feed)

request line(GET, POST,

HEAD commands)

header

Carriage return,

line feed indicates end of message

HTTP Response Message Format

HTTP version status code sp status phrase cr lf

response linesp

Response Body

header lines

HTTP Response Example

HTTP/1.0 200 OK Date: Thu, 25 Aug 2001 12:00:15 GMT Server: Apache/1.3.0 (Unix) Last-Modified: Mon, 22 Aug 2001 …... Content-Length: 6821 Content-Type: text/html data data data data data ...data data data data data ... data data data data data ...

header

status line:(protocol

status codestatus

phrase)

data, e.g., requestedhtml file

Carriage return,

line feed indicates end of message

CGI Architecture

Objectives

• Standardizes execution of server-side applications/handlers

• Specifies:

– Interface between client and handler

– Interface between web server and hander

Web Server-Handler Interaction

• Handler Input– Meta-variables– Stdin (message body)

• Handler Output– Stdout

Client-Handler Interaction

• Clients request the execution of a handler program by means of a:– A request method (e.g., GET, POST)– Universal Resource Identifier (URI)

• Identifies handler – Extra arguments

URI Syntax

http://finance.yahoo.com/add?op1=10&op2=20

<protocol> http

<host> finance.yahoo.com

<port> 80

<path-info> null

<script> add

<query-string> op1=10, op2=20

Query String Encoding

• RFC 2396

• Why encode? Can think of a CGI script as a function, send

arguments by specifying name/value pairs. Way to pack and unpack multiple arguments into

a single string

Encoding Rules

All arguments Single string of ampersand (&) separated name=value

name_1=value_1&name_2=value_2&...

Spaces Replaced by a plus (+) sign

Other characters (ie, =, &, +) Replaced by a percent sign (%) followed by the two-digit

hexadecimal ASCII equivalent

Method

• GET– Arguments appear in the URL after the ? – Can be expressed as a URL– Limited amount of information can be passed this way– URL may have a length restriction on the server– Arguments appear on server log

• POST Arguments are sent in the HTTP message body Cannot be expressed as URL Arbitrarily long form data can be communicated (some

browsers may have limits (i.e. 7KB)). Arguments usually does not appear in server logs.

Forms and CGI

• Specify request method in “method” attribute• Automatically encodes all named field values

Example: add.html

Servlets• Generic Java2EE API for invoking and connecting

to “mini-servers” (lightweight, short-lived, server-side interactions).

• Mostly HTTPServlets– Generate HTTP responses (as for CGI)– Servlet code snippets can be embedded directly

into HTML pages: JSP = Java Server Pages• Competitor: Microsoft ASP = Active Server

Servlet Architecture

Web server: Apache, Netscape Enterprise, IIS

Servlet container: Running JVM, hooked into the web server, loads and maintains servlets, session info, object store

Servlet: A Java class used to handle a specific request.

Main Process

Java Servlet-Based Web Server

Servlet1

Request for Servlet1

Request for Setvlet2

Request for Servlet1

Servlet2

Thread

Servlet API (javax.Servlet)

• Servlet Container

• Servlet Interface

• HttpServletResponce

• HttpServletRequest

• ServletContext

Servlet Container

Contains and manages servlets through their lifecycle

Provides the network services over which requests and responses are sent

Decodes requests Formats MIME based responses

Servlet Interface

Central abstraction of the servlet API

All servlets either implement this interface,

or extend a class that implements this

interface

GenericServlet and HttpServlet two classes

in the servlet API that implement the

Servlet interface

HttpServlet

Web developers extend HttpServlet to implement their servlets.

Inherited from GenericServlet Init() Destroy()

Defined by HTTPServlet doGet() doPost()

doGet() and doPost()

protected void doGet(HttpServletRequest req,

HttpServletResponse resp)

protected void doPost(HttpServletRequest req,

HttpServletResponse resp)

HttpServletResponse Encapsulates all information to be returned from the server to

the client In the HTTP protocol, this information is transmitted from

the server to the client either by HTTP headers or the message body of the request.

Headers: Can set/manipulate http headers primitive manipulation: setStatus(), setHeader(), addHeader()

convenience methods: setContentType(), sendRedirect(), sendError()

Body: Obtain a PrintWriter, used to return character data to the client getWriter()

Example: Hello World

HttpServletRequest Encapsulates all information from the client request

In the HTTP protocol, this information is transmitted from the client to the server in the HTTP headers and the message body of the request.

Manipulate 'form' variables:

getParameter()

getParameterNames()

getParameterValues()

Example: Form

Environment Variables

DOCUMENT_ROOT root directory of your server

HTTP_COOKIE visitor's cookie, if one is set

HTTP_HOST hostname of the page

HTTP_REFERER

HTTP_USER_AGENT browser type of the visitor

HTTPS "on" if called through a secure server

QUERY_STRING query string

REMOTE_ADDR IP address of the visitor

REMOTE_HOST hostname of the visitor

REMOTE_USER visitor's username

REQUEST_METHOD GET or POST

REQUEST_URI

SCRIPT_FILENAME The full pathname of the current CGI

SERVER_SOFTWARE server software (e.g. Apache 1.3)

Example: Environment Variables

Tomcat ConfigurationTomcat

webapps

csc309Servlets Root

index.jspindex.html

server.xml

WEB-INF

classes

web.xml

HelloWorld.class

web.xml

tomcat_users.xml

SomeOther.class

Deployment Descriptor (web.xml)• $CATALINA_HOME/conf/web.xml

– Default for all web applications• $CATALINA_HOME/webapp/ece1779Servlets/WEB_INF/web.xml

– Specific to ece779Servlets <servlet> <servlet-name>SampleServerName</servlet-name> <servlet-class>HelloWorld</servlet-class> </servlet> <servlet-mapping> <servlet-name>SampleServletName</servlet-name> <url-pattern>/index.html</url-pattern> </servlet-mapping>

http://127.0.0.1:8080/ece1779Servlets/index.htmlMaps to:

$CATALINA_HOME/webapp/ece1779Servlets/WEB_INF/classes/HelloWorld.class

$CATALINA_HOME/conf/tomcat_users.xml

<?xml version='1.0' encoding='utf-8'?>

<tomcat-users>

</tomcat-users>

Tomcat Web Application Manager

• Deploy applications

• Start/stop/reload

Servlet Debugging

• Logs

– $CATALINA_HOME/logs

• Interactive debugger

– Use Java JPDA interface

• Allows an external program to “attach” to process

– Start Tomcat in debugging mode

• $CATALINA_HOME/bin/catalina.sh jpda start

– Start IDE debugger

– Attach debugger to running Tomcat instance

Session Maintenance

HTTP is stateless by default

No memory of browsers state

Preserving state between browser/web server interactions

Behavior reflects previous forms filled in and pages viewed

Kept at the browser or/and web server.

Example: Want to allow access to a given script only once a user is logged in. Don't want to require a user to login at every page.

Store State At Server

Current state is stored at the server (i.e., in a file, database, or in JVM’s memory)

Each request includes a token identifying the browsers session (tokens can be passed via cookies, hidden variables, URL rewriting).

At each request, the executing servlet uses the token to fetch session state

Careful: Browser back button problem. The page the user is viewing may not reflect state stored at the server.

HttpSession One instance for each active session

Accessing/creating a session

HttpSession session = request.getSession(); Session attributes

Object o = session.getAttribute("name");

session.setAttribute("name",o);

Session Duration • Default: expire a session if idle (no http requests) for 30 minutes

– Delete all session related attributes from server– Does not remove cookie from client

• Changing session timeout– Configuration file (web.xml)

<session-config> <session-timeout>30</session-timeout> </session-config>

– Run-time• session.getMaxInactiveInterval()• session.setMaxInactiveInterval()

• Terminating a session– session.invalidate()– Deletes session related attributes form server– Removes cookie from client

Session Example

Other Issues• Multithreading

– HttpSession is not thread safe– Use proper synchronization to prevent concurrent property modifications

• Persistent sessions

– Tomcat has support for persistent sessions

• Survive server restart– Saves session data to a file– Serializes properties

• Property values need to be serializable• Session event listeners

– Possible to create servlets that execute when a session times out– Can be use to garbage collect resources outside of the JVM

ServletContext Interface defines a servlet’s view of the web application within

which the servlet is running.

Container Provider is responsible for providing an implementation of the ServletContext interface in the servlet container.

Using the ServletContext object, a servlet can

log events

obtain URL references to resources

set attributes that other servlets in the context can access.

ServletContext Continued• One instance of ServletContext per web application per container

ServletContext context = getServletContext();

• Provides access to Initialization Parameters Defined in the deployment descriptor

A file called web.xml in the WEB-INF subdirectory of the app directory

Methods:

getInitParameter(),

getInitParameterNames()

ServletContext Attributes Context level shared objects. Can be bound into the context

and accessed by any servlet that is part of the application.

Methods:

setAttribute()

getAttribute()

getAttributeNames()

removeAttributes()

More than 1 thread may be accessing a shared object.

Application developer responsible for synchronizing access to shared objects

ServletContext Resources

Gives servlet access to local documents associated with the application. (i.e. static web pages, images)

Access to server logs

Methods:

getResource()

getResourceAsStream()

getResourcePaths()

log(“Error! File does not exist”);

ServletContextExample

JSP• Servlets disadvantage

–A little java in a whole lot of HTML

• Java Server Pages

–Java embedded in HTML

• Deployed in textual form (as opposed to byte code)

• Translated to into a servlet on the fly$CATALINA_HOME/webapps/ece1779/hello.jsp

$CATALINA_HOME/work/Catalina/localhost/ece1779/org/apache/jsp/hello_jsp.java

JSP Life Cycle

JSP• Expressions

<%= object.function() %>

Java expression that evaluates into a String

Translated into out.print() statement• Scriplets

<% java.util.Date currentTime = new java.util.Date;String strDate = currentTime.toString();

One or more Java statements

Left in place• Directives

<%@ page import=“java.util.Date, java.text.SimpleDateFormat” %>

<%@ page contentType="text/html; charset=UTF-8" %>

<%@ taglib prefix="s" uri="/struts-tags" %>• Tags

<s:iterator value="posts" status="itStatus“>

<s:form action="AddPost“>

<s:textfield name="username" label="Your name"/>

Movieplex Example

DesignContent

All data stored in Movieplex.java

- Array of movies

- Array of theatres

- Array of showtimes

Initialization

Initialization.java

- Servlet that creates Movieplex object and stores in ServletContent

Regular operation

ListTheaters.jsp

- Retrieves movie data from servlet context

- Renders HTML page with list of all available theatres

ShowTheater.jsp

- Takes theaterid as parameter

- Renders HTML listing all the movies currently shown at a theatre

Data Structures

public class Movie {

public int id;

public String name;

public String rating;

public String starring;

public String director;

public String synopsis;

public String poster;

public String url;

public class Theater { public int id; public String name; public String address; public String phone;}

public class Showtime { public int id; public int theaterid, movieid; public int year, month, day; // date public int hour, minute; // time of day public float price;}

Data Structurespublic class Movieplex {

public Theater [] theaters;

public Movie [] movies;

public Showtime [] showtimes;

public Movieplex() {

Theater [] t = { new Theater(1,"Canada Square","2190 Yonge Street, Toronto, ON, M4S2C6", "416-6460444"),

new Theater(2,"SilverCity","2300 Yonge Street, Toronto, ON, M4P1E4","416-5441236") };

this.theaters = t;

Movie [] m = { new Movie(1,"Casino Royale", "PG-13","Daniel Craig, Judi Dench, Mads Mikkelsen, Eva Green, Jeffrey Wright", ......),

new Movie(2,"Babel", "R", "Brad Pitt, Cate Blanchett, Gael Garcia Bernal, Elle Fanning, Koji Yakusho", ... ) };

this.movies = m;

Showtime [] s = { new Showtime(1,1,1,2007,3,23,18,0,8),

new Showtime(2,1,1,2007,3,18,20,0,8) };

this.showtimes = s;

Three Tier Architecture

• Relational Database Management Systems

• A way of saving and accessing data on persistent (disk) storage.

Why Use an RDBMS

• Data Safety– data is immune to program crashes

• Concurrent Access– atomic updates via transactions

• Fault Tolerance– replicated dbs for instant fail-over on machine/disk crashes

• Data Integrity– aids to keep data meaningful

• Scalability– can handle small/large quantities of data in a uniform manner

• Reporting– easy to write SQL programs to generate arbitrary reports

RDBMS Technology

• Client/Server Databases

– Oracle, Sybase, MySQL, SQLServer

• Personal Databases

– Access

• Embedded Databases

– Pointbase

Serverserver process

disk i/o

Client/Server Databases

client clientclient processes

tcp/ip connections

client application

Inside the Client Process

tcp/ip connection to server

db library

JDBC JDBC (Java DataBase Connectivity)

Standard SQL database access interface.

Allows a Java program to issue SQL statements and process the results.

DB independent. Can replace underlying database with minimal code impact.

Defines classes to represent constructs such as database connections, SQL statements, result sets, and database metadata.

A JDBC Application

JDBC Pieces Java client: code implementing the application

JDBC API. Provides DB independent abstraction to

establish a connection with a database

send SQL statements

process the results JDBC Driver

Translates API calls to requests made against the specific database. Specific driver for the each database. Installed on the client. Usually a set of class files placed in the class path.

e.g., mysql-connector-java-5.1.7-bin.jar All large databases are now supported.

Database server:

The actual database engine

Pointbase, Oracle, MSAccess, SQL Server, Postgresql etc.

JDBC • Package java.sql

java.sun.com/products/jdk/1.2/docs/api/java/sql/package-summary.html

• Classes and interfaces– DriverManager getConnection()

– Connection Transactionscommit(), rollback(), setAutoCommit()

SQL statementscreateStatement(), prepateStatement()

– Statement executeQuery(), executeUpdate()

– ResultSet Scrolling over tuples next(), previous(), first(), last(), isLast()

Values of attributesgetString(int index), getTime(String name)

– PreparedStatement executeQuery(), executeUpdate()setInt (int index, int x)

API: Establish Connection1 Class.forName(com.mysql.jdbc.Driver)

make the driver class available

2 String url = “jdbc:mysql://sysnet.cs.toronto.edu/databasename";

This is the connect string. The connect string, mentions the driver as well as the database. For the example above, the driver is the jdbc:pointbase:embedded bridge driver. The database is sample.

3 Connection con=DriverManager.getConnection(url, uID, pw);

Get a connection (session) with a specific database. Within the context of a Connection, SQL statements are executed and results are returned.

A Connection can be used to obtain information about the DB By default a Connection automatically commits changes after each statement.

Typically, setting up a connection is an expensive operation.

API: Executing Queries

A query can return many rows, each with many attributes

Steps are

1 Send query to the database

2 Retrieve one row at a time

3 For each row, retrieve attributes

Trivial Example

API: Updates

Int rowsAffected=

stmt.executeUpdate(

"DELETE * FROM ACCOUNTS;");

Executes a SQL INSERT, UPDATE or DELETE statement. Returns the number of rows affected.

API: Prepared Statements

Is a parameterized SQL statement.

Used to speedup query parsing (statement does not need to be reparsed)

Used to simplify development (clumsy strings do not have to be created and recreated for each update).

Example:String insert="INSERT INTO ACCOUNT(NAME,AMOUNT)VALUES(?,?);"; PreparedStatement ps =con.prepareStatement(insert);

ps.setString(1,"Charlie"); // Fill in the first ?ps.setDouble(2,23.45); // Fill in the second ?

rowsEffected=ps.executeUpdate();

ps.setInt(1,"Arnold"); // Fill in the first ?ps.setInt(2,102.23); // Fill in the second ?

rowsEffected=ps.executeUpdate();

Scope of DB Connections

1. Request: Open/close connection on each action invocation

2. Session: Keep 1 open connection associated with the session: HttpSession.getParameter(“dbCon”)

3. Web App: Keep 1 open connection for the web application and re-use it

Connection Pooling• The Solution:

– Maintain a pool of open connections that time themselves out• The SharedPoolDataSource allocates a new Connection object

– It wraps it in a PoolingConnection object that delegates calls to its enclosed Connection object and returns it to the client.

– It sets a timeout that will reclaim the Connection for a pool of free connections

• If client accesses PoolingConnection after timeout, PoolingConnection will request a fresh connection from the pool.

• Client returns Connection to the pool when done with it.– SharedPoolDataSource does not close the Connection, rather saves it for

the next request• Client may block awaiting a freed connection if some maximum upper limit

of open connections is reached.

Connection Pooling

– Init method of main webapp servlet:

// Create a data sourceDriverAdapterCPDS ds = new DriverAdapterCPDS();ds.setDriver("com.mysql.jdbc.Driver");ds.setUrl("jdbc:mysql://servername/databasename");ds.setUser("public");ds.setPassword("public");

// Create a connection poolSharedPoolDataSource dbcp = new SharedPoolDataSource();dbcp.setConnectionPoolDataSource(ds);

//Add to webapp contextgetServletContext().setAttribute(“dbConPool”,dbcp);

Connection Pooling– Each servlet doGet() or doPost() calls:

SharedPoolDataSource dbcp = getServletContext().getAttribute(“dbConPool”);

Connection con = dbcp.getConnection();…Statement s = con.createStatement();…con.close();

Indirection and Capabilities

Servletconnection x

connection

Poolingconnection

private connection x

onTimeOut: x = null

Servletdbonnection y

Cannot revoke capability

Indirection enables revoking capability

Capability: enforces access control by providing a handle to a resource.

SQLGateway

Atomic Transactions

• ATM banking example:

– Concurrent deposit/withdrawal operation

– Need to protect shared account balance

• What about transferring funds between accounts?

– Withdraw funds from account A

– Deposit funds into account B

Properties of funds transfer

• Should appear as a single operation

– Another process reading the account balances should see either both updates, or none

• Either both operations complete, or neither does

– Need to recover from crashes that leave transaction partially complete

Transactions• Definition: A transaction is a collection of DB modifications, which is

treated as an atomic DB operation.

– Transactions ensure that a collection of updates leaves the database in a consistent state (as defined by the application program); all updates take place or none do.

– A sequence of read and write operations, terminated by a commit or abort

• Definition: Committed– A transaction that has completed successfully; once committed, a transaction

cannot be undone

• Definition: Aborted – A transaction that did not complete normally

• JDBC: By default the Connection automatically commits changes after executing each statement. If auto commit has been disabled, the method commit must be called explicitly; otherwise, database changes will not be saved.

API: TransactionsExample:// Change to transactional mode

con.setAutoCommit(false);

// Transaction A begins here

stmt.executeUpdate("DELETE * FROM ACCOUNT...;");// 1

stmt.executeUpdate("INSERT INTO ACCOUNT ...."); // 2

con.commit();

// Commit changes to database

// All of 1,2,3,4 take effect

API: TransactionsExample:

// Transaction B begins here

stmt.executeUpdate("DELETE * FROM SALES...;"); // 5

stmt.executeUpdate("INSERT INTO SALES ...."); // 6

con.rollback();

// Rollback to before transaction B began

// None of 5,6,7,8 effects the DB

Example

• Movie database

• Add an order and decrement # of available spaces

showtimeid movieid theatherid sdate stime available1 1 1 20/03/2005 20:00:00 902 1 1 20/03/2005 22:00:00 90

showtimes

orderid userid showtimeid1 1 1

orders

Web Application Development 1. Outline Web application architecture HTTP CGI Java Servlets Apache...

Documents

Transcript of Web Application Development 1. Outline Web application architecture HTTP CGI Java Servlets Apache...

Using DBMaker with J2EE Application Server ManualUsing DBMaker with J2EE Application Server Manual 10 4. About Tomcat The Tomcat server is a Java-based Web Application container that

Uniface Lectures Webinar - Application & Infrastructure Security - Hardening Tomcat

Agenda - jumpingbean.co.za€¦ · Log Tuning JVM Tuning Load balancing Tomcat. Tomcat Performance Tuning Tomcat Versions. Application/System Monitoring Setup a system to monitor

Enterprise JavaBeans Programming (20 Hours) · Enterprise JavaBeans Programming (20 Hours) Application Server Concepts and Choices Tomcat Tomcat is the official reference implementation

Apache Tomcat Server Administration - Timicoseddon-software/JEE/Tomcat Administration.pdf · Apache Tomcat Server Administration 1. Introduction to Tomcat 2. Deploying Servlets and

Object-Oriented Enterprise Application Development Advanced Servlets.

Apache Tomcat as a container for Servlets and JSP

APACHE TOMCAT APPLICATION SERVER - CenturyLink · APACHE TOMCAT APPLICATION SERVER (TOMCAT) Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer

develop servlets How to - University of Missouri-St. Louissiegelj/CS4010/Servlets/Chapter5js.pdf · develop servlets . Murach's Java Servlets/JSP ... Murach's Java Servlets/JSP (3rd

Introduction to Web Applications using JSP, Servlets, Jstl ...ahchinaei/.../icom5016/09ICOM5016JSPsServlets.pdfMediaDB: A ICOM5016 project Requirements Setting Eclipse and Tomcat Examples

Create a Servlet in Eclipse - Training Material...Create a Servlet in Eclipse Tomcat has several examples of Servlets. In this document one of these example Servlets will be used to

VCR Asset WebSphere Application Server Liberty Profile Compared to Tomcat

111 Java Servlets Dynamic Web Pages (Program Files) Servlets versus Java Server Pages Implementing Servlets Example: F15 Warranty Registration Tomcat Configuration.

Weblogic Application Deployment Automation.… · Weblogic, JBoss, Tomcat, Websphere, Tomcat and .Net ... Weblogic Application Deployment Automation has a unique deployment model

The Tomcat Servlet Container. About Tomcat A “servlet container” is like a mini server, but only for serving html, jsp and servlets. Many servlet containers.

Apache Jakarta Tomcat 20041058 Suh, Junho. Road Map Tomcat Overview Tomcat Overview History History What is Tomcat? What is Tomcat? Servlet Container.

Jamf Pro Installation and Configuration Guide for Windows · Apache Tomcat Tomcat is the web application server that runs the Jamf Pro web app. A directory named Tomcat is installed

webapp and the Graal Apache Tomcat, your · Use webapp packaging Ant script from tomcat-maven to: Precompile JSPs Add tomcat-web.xml to webapp for JSP Servlets declaration Copy all

Example Student Record Application. Environment Run environment: JDK 1.4 Run environment: JDK 1.4 Web server: TOMCAT as JSP container Web server: TOMCAT.

Installing on Apache Tomcat Application Server 11g