7735978-Servlets and the Java Web Server

8/8/2019 7735978-Servlets and the Java Web Server

1/127

11/04/08 Copyright 1997-8, Purple Te 1

Servlets and the Java Web Server

Server-Side Programming Made Easy

Written by Alex Chaffee ([email protected])Contents Copyright (c) 1998 Purple Technology, Inc.


2/127

Copyright 1997-8, Purple Technology Inc. 2


11/04/08

Course OutlineServlet OverviewServlet OverviewUsing ServletsUsing Servlets

Writing ServletsWriting ServletsSaving StateSaving StateJava Web Server FeaturesJava Web Server Features

Appendix: CGI TutorialAppendix: CGI TutorialAppendix: FAQAppendix: FAQ

Inside the Exercises Handout


3/127


Section I

Servlet OverviewServlet Overview


4/127



11/04/08

What Is A ServletA Java objectA Java objectPlug-in for a web server Plug-in for a web server

Replacement for CGI scriptsReplacement for CGI scriptsCan also be used to extend server as a plug-in

Full power of JavaFull power of JavaPlatform-independentDatabase accessFun to write


5/127



11/04/08

Server/Service/Servletserver - a process running on a hostserver - a process running on a hostmachinemachine

Apache, Java Web Server

service - a protocol running on a portservice - a protocol running on a portHTTP, FTP

servlet - a module running inside a serviceservlet - a module running inside a servicePhoneServlet


6/127



11/04/08

Servlet/Service/Server Diagram

(diagram from Java Web Server tutorial)(diagram from Java Web Server tutorial)


7/127



11/04/08

Servlets vs. AppletsServlets have no GUIServlets have no GUIServer-side, not client-sideServer-side, not client-side

Different security modelDifferent security modelInstalled, not downloadedInstalled, not downloaded

But you can download remote servlets too

Consistent server-side VMConsistent server-side VMMuch easier to test


8/127



11/04/08

Servlets vs. CGI"performance, flexibility, portability, and"performance, flexibility, portability, andsecurity" (whitepaper)security" (whitepaper)

Faster and Leaner Faster and Leaner

No fork-process like Perl No need to initialize for each requestOnly lightweight thread context switching

Built-in multithreading


9/127



11/04/08

Servlets vs. CGI (Cont.)Easy to manage stateEasy to manage state

share data across successive requestsshare data between concurrent requestsuse hidden fields, cookies, or sessions

Write once, run anywhereWrite once, run anywhereIt's easy to write unportable Perl

Servlets have standard APISupports all methodsSupports all methods

GET, POST, PUT, DELETE, et al.


10/127



11/04/08

Servlets vs. FastCGIFastCGI sends multiple requests to a singleFastCGI sends multiple requests to a singleseparate processseparate process

requires process context switch

Servlets send multiple requests to multiple threadsServlets send multiple requests to multiple threadsin same processin same process

requires lightweight thread context switch

(Also applies to ISAPI)(Also applies to ISAPI)Nice diagram in White Paper Nice diagram in White Paper Servlets also automatically take advantage of Servlets also automatically take advantage of multiprocessorsmultiprocessors

if the underlying JVM does


11/127



11/04/08

Supported ServersJava Web Server Java Web Server ApacheApache

NetscapeNetscapeMany others (see web site)Many others (see web site)Servlet EnginesServlet Engines

IBM's ServletExpressLive Softwares JRun


12/127



11/04/08

Servlet SecurityTrusted Servlets (full access)Trusted Servlets (full access)

JWS InternalLocal (in the "servlets" directory)

Servlet SandboxServlet SandboxSigned Network Servlets (full access)Unsigned Network Servlets (limited access)


13/127



11/04/08

Servlet Security: ImplicationsIT managers can sign servlets for use inIT managers can sign servlets for use intheir organizationtheir organizationISPs can allow users to run servletsISPs can allow users to run servlets

less of a security hole than CGI scripts, since Java issafe and secure (at least more so than C or Perl)still allows denial-of-service attacks

Network servlets are possibleNetwork servlets are possiblechaining / proxyingallows agentscommon servlet repository for multiple servers

one place to install updates


14/127



11/04/08

Servlet Security: ProblemsToo simplisticToo simplistic

All or nothing

Should allow ACLs for particular signersShould allow ACLs for particular signers

They claim it will in a future version

Should get better with 1.2 security modelShould get better with 1.2 security modelFiner-grained access control


15/127



11/04/08

Servlet Client SecurityJava Web Server Java Web Server

Allows Access Control Lists for clientsSupports HTTP authenticationSupports Digest Authentication

Other Web ServersOther Web ServersUsually support HTTP authentication

May have other security features


16/127



11/04/08

SSL in JWSIt worksIt worksExtra $$Extra $$

https: supportedhttps: supportedDigest Authentication supportedDigest Authentication supported

SSL 3 (client certificates) required


17/127



11/04/08

Authenticating the users identityHTTP AuthenticationHTTP Authentication

Username/password sent to server on every request(like cookies)Very light encryption (uuencode)

Digest AuthenticationDigest AuthenticationCryptographic handshaking between client and

server Very good encryption Not supported by all servers/browsers


18/127



11/04/08

User Authentication Methodsrequest.getRemoteUser()request.getRemoteUser()

returns username

request.getAuthType()request.getAuthType()

HTTP or Digest

request.getScheme()request.getScheme()http or https


19/127



11/04/08

API AvailabilityStandard Java Extension APIStandard Java Extension API

From white paper: "This means that while it is not part of the core Java framework which must always be part of all products bearing the Java brand, it will be made available with such products by their vendors as an add-on package."

package javax.servlet.*, javax.servlet.http.*package javax.servlet.*, javax.servlet.http.*


20/127



11/04/08

Servlet Architectures:Three-tier system

Tier 1: ClientTier 1: ClientHTML browser Java client

Tier 2: ServletsTier 2: Servletsembody business logicsecure, robust

Tier 3: Data SourcesTier 3: Data SourcesJava can talk to SQL, CORBA, OODB, File system,etc. etc.


21/127



11/04/08

Servlet Architectures: N-tier system

Tier 1: HTML Browser Tier 1: HTML Browser Tier 2: ServletTier 2: Servlet

User interface

Tier 3: EJB/CORBA/RMI ObjectsTier 3: EJB/CORBA/RMI ObjectsBusiness logic

Tier 4: Other Servers (e.g. RDBMS)Tier 4: Other Servers (e.g. RDBMS)Data storage


22/127



11/04/08

Servlet Architectures: Web Publishing

SSI ServletsSSI ServletsJSP ServletsJSP Servlets

Best to keep business logic inside Java objectsKeep the JSP light so designers dont get scared

Chaining servletsChaining servletsMultiple serversMultiple servers

data gathering, collecting, serving, load balancing,etc.


23/127


Section II

Using ServletsUsing Servlets


24/127



11/04/08

Loading ServletsFrom CLASSPATHFrom CLASSPATH

includes /classes/ on JWS

From /servlets/ directoryFrom /servlets/ directorynot in classpathservlets can be added or recompiled inside a runningserver

class.initArgs fileFrom remote codebaseFrom remote codebase

specified by URL


25/127



11/04/08

Remote ServletsThree ways to configureThree ways to configure

configure with Administration Toolinvoke inside a server-side includeconfigure inside a servlet chain

Loaded in a Servlet SandboxLoaded in a Servlet Sandboxmore later


26/127



11/04/08

What's In A NameA servlet's name is its class nameA servlet's name is its class name

if it's in the servlets directory

Or, you can assign it a name in the "AddOr, you can assign it a name in the "AddServlet" admin toolServlet" admin tool

maps code word to servlet class

Name is usually a single wordName is usually a single word possibly with a package name and dotsno other punctuation


27/127



11/04/08

Standard ServletsDateServletDateServlet

echoes current date/timeEchoServletEchoServlet

echoes CGI parameters (good for testing)MailServletMailServlet

sends email in response to a CGI formRedirectServletRedirectServlet

used by server to manage HTTP redirects

SessionServletSessionServletused by server to manage sessionsMany more...Many more...


28/127



11/04/08

Server-side Includes (SSI)Must be in a file named .shtml or .jspMust be in a file named .shtml or .jsp

can change this with Admin Tool

Normal SSINormal SSI

Servlet SSIServlet SSI


29/127



11/04/08

SSI Detailspass init parameters in servlet tagpass init parameters in servlet tagpass servlet parameters in param tagspass servlet parameters in param tags

can specify codebase in servlet tagcan specify codebase in servlet tage.g.e.g.


30/127



11/04/08

URL invocationDirectly from browser as URLDirectly from browser as URL

http://www.myserver.com/servlet/MyServletFrom inside FORM tag as scriptFrom inside FORM tag as script...

From inside JHTML or JSP pageFrom inside JHTML or JSP pageUses Page CompilationCompiles the jsp file into a servlet on the fly, thenexecutes it


31/127



11/04/08

A Note on CLASSPATH and JWS

JWS uses its own JREJWS uses its own JREThree ways to add classesThree ways to add classes

Put the class files into the classes subdirectoryJar them, and put the jar files into the libsubdirectoryStart the server with the -classpath option

httpd -classpath c:\projects\utils


32/127


Section III

Writing ServletsWriting Servlets


33/127



11/04/08

The Servlet APIIndependent of Independent of

web protocolserver brand or platformwhether it's local or remote

Simple, small, easySimple, small, easyBase class provides core functionality; justBase class provides core functionality; just

extend itextend it

S l d h b S


34/127



11/04/08

CGI, or not, whichever Fairly generic interfaceFairly generic interfaceAccepts query, returns responseAccepts query, returns response

Used for plugins, etc.Used for plugins, etc.

S l d h J W b S


35/127



11/04/08

Servlet Architecture OverviewServlet InterfaceServlet Interface

methods to manage servlet

GenericServletGenericServletimplements Servlet interface

HttpServletHttpServletextends GenericServlet

exposes HTTP-specific functionality

S l t d th J W b S


36/127



11/04/08

Servlet Architecture OverviewServletRequestServletRequest

What the client says to the server Access to information like protocol, client IP#,

parameters, and body

ServletResponseServletResponseWhat the servlet says to the client

HttpServletRequest, HttpServletResponseHttpServletRequest, HttpServletResponseHTTP-specific communication and informationState-tracking and session management

S l t d th J W b S


37/127



11/04/08

Servlet Lifecycle OverviewServer loads and instantiates servletServer loads and instantiates servletServer calls init()Server calls init()

LoopLoopServer receives request from clientServer calls service()service() calls doGet() or doPost()

Server calls destroy()Server calls destroy()More detail to come later...More detail to come later...

Ser lets and the Ja a Web Ser er


38/127



11/04/08

ServletRequestpassed to the service() methodpassed to the service() methodcontains lots of useful goodiescontains lots of useful goodies

Client infoURL infoContent infoContent itself

User-entered parameters



39/127



11/04/08

ServletRequest - Client InfogetRemoteAddr()getRemoteAddr()

Returns the IP address of the agent that sent the requestgetRemoteHost()getRemoteHost()

Returns the fully qualified host name of the agent thatsent the request

getProtocol()getProtocol()Returns the protocol and version of the request as astring of the form /..



40/127



11/04/08

ServletRequest - URL InfogetScheme()getScheme()

Returns the scheme of the URL used in this request, for example "http", "https", or "ftp".

getServerName()getServerName()

Returns the host name of the server that received therequest

getServerPort()getServerPort()Returns the port number on which this request wasreceived

getServletPath()getServletPath()Returns the URI path that got to this script, e.g./servlet/com.foo.MyServletUseful for putting in a tag

See also getRequestURI() (in HttpServletRequest)



41/127



11/04/08

ServletRequest - Content InfogetContentLength()getContentLength()

Returns the size of the request data

getContentType()getContentType()Returns the MIME type of the request data



42/127



11/04/08

ServletRequest - ContentgetInputStream()getInputStream()

Returns an input stream for reading binary data inthe request body.

getReader()getReader()Returns a buffered reader for reading text in therequest body.



43/127



11/04/08

ServletRequest - ParametersString getParameter(String)String getParameter(String)

Returns a string containing the lone value of the specified parameter,or null if the parameter does not exist.Was deprecated, but due to popular demand, it'll be undeprecated

String[ ] getParameterValues(String)String[ ] getParameterValues(String)Returns the values of the specified parameter for the request as anarray of strings, or null if the named parameter does not exist.For parameters with multiple values, like lists

Enumeration getParameterNames()Enumeration getParameterNames()Returns the parameter names for this request as an enumeration of strings, or an empty enumeration if there are no parameters or theinput stream is empty.



44/127



11/04/08

ServletResponseEmbodies the responseEmbodies the responseBasic use:Basic use:response.setContentType("text/html");PrintWriter out = response.getWriter();out.println(

"Hello");



45/127



11/04/08

ServletResponse - OutputgetWriter()getWriter()

for writing text data

getOutputStream()getOutputStream()for writing binary dataor for writing multipart MIME

you must call setContentType() beforeyou must call setContentType() before

calling getWriter() or getOutputStream()calling getWriter() or getOutputStream() by default it's text/plain, which you don't want



46/127



11/04/08

The GenericServlet classimplements Servletimplements Servletalso implements Serializable, ServletConfigalso implements Serializable, ServletConfig

implements all Servlet methodsimplements all Servlet methodsso you don't have to



47/127



11/04/08

The HelloWorld Servletimport javax.servlet.*;import java.io.*;public class HelloServlet extends GenericServlet{

public void service(ServletRequest req,ServletResponse res)

throws IOException, ServletException{

res.setContentType("text/plain");ServletOutputStream out = res.getOutputStream();out.println("Hello, World!");

}}



48/127

Copyright 1997-8, Purple Technology Inc. 4811/04/08

The HttpServlet classextends the GenericServlet base classextends the GenericServlet base classprovides a framework for handling theprovides a framework for handling theHTTP protocolHTTP protocolhas its own subclasses of ServletRequesthas its own subclasses of ServletRequestand ServletResponse that do HTTP thingsand ServletResponse that do HTTP things



49/127


HttpServlet methodsprovides helper methods for HTTP methodsprovides helper methods for HTTP methods

doGet (GET and HEAD)doPost (POST)doPut, doDelete (rare)doTrace, doOptions (not overridden)

the service() method dispatches requeststhe service() method dispatches requests

to the do* methodsto the do* methods



50/127


HttpServlet: Receiving DatagetParameter / getParameterValues /getParameter / getParameterValues /getParameterNamesgetParameterNames

process the data and return you the parametersgetQueryStringgetQueryString

for GET methodreturns a single string in url-encoded format

getReader / getInputStreamgetReader / getInputStreamfor POST, PUT, DELETEreturns a stream of characters / bytes

mutually exclusivemutually exclusiveuse EITHER getParameter* OR one of the others (never

both)



51/127


SimpleServlet (GET)public class SimpleServlet extends HttpServlet {public void doGet(HttpServletRequest req, HttpServletResponse res)

throws ServletException, IOException {// set header field firstres.setContentType("text/html");// then get the writer and write the response dataPrintWriter out = res.getWriter();out.println(

" SimpleServletOutput");

out.println(" SimpleServlet Output ");out.println("

This is output is from SimpleServlet.");out.println("");

out.close();}public String getServletInfo() { return "A simple servlet"; }

}



52/127


DateServlet public class DateServlet extends HttpServlet {

public void service( HttpServletRequest req,

HttpServletResponse res)throws ServletException, IOException

{Date today = new Date();res.setContentType("text/plain");ServletOutputStream out = res.getOutputStream();out.println(today.toString());

}public String getServletInfo() {

return "Returns a string representation of the currenttime";

}}

From Java Web Server Tutorial by Sun Microsystems



53/127

Copyright 1997-8, Purple Technology Inc.5311/04/08

HelloHttpServletReads in a parameter Reads in a parameter

Can use a form

Can use right in a URL

http://localhost:8080/servlet/HelloHttpServlet?name=Fred

Outputs it as HTMLOutputs it as HTML



54/127


HelloHttpServletpublic class HelloHttpServlet extends HttpServletpublic class HelloHttpServlet extends HttpServlet{{

public void doGet(HttpServletRequest req,public void doGet(HttpServletRequest req,HttpServletResponse res)HttpServletResponse res) throws IOException,throws IOException,

ServletExceptionServletException{{

String name = req.getParameter("name");String name = req.getParameter("name");if (name == null) name = "Joe";if (name == null) name = "Joe";

res.setContentType("text/plain");res.setContentType("text/plain");ServletOutputStream out = res.getOutputStream();ServletOutputStream out = res.getOutputStream();out.println("Hello, " + name + "!");out.println("Hello, " + name + "!");

}}}}



55/127


More Advanced ServletsSee Post ServletSee Post Servlet

from Servlet Tutorial



56/127


HttpServletRequestCookie[ ] getCookies()Cookie[ ] getCookies()

returns list of cookies sent by client

String getMethod()String getMethod()GET, POST, etc.

String getRequestURI()String getRequestURI()returns the URI or URL that was invoked

useful for putting inside tag



57/127


HttpServletRequest (Cont.)CGI Variable MethodsCGI Variable Methods

getServletPath(), getPathInfo(), getPathTranslated(),getQueryString(), getRemoteUser(), getAuthType()

String getHeader(String name)String getHeader(String name)Session Management MethodsSession Management Methods

HttpSession getSession(boolean create)

More later...



58/127


HttpServletResponseContains HTTP status codes as constantsContains HTTP status codes as constants

int HttpServletResponse.SC_NOT_FOUND = 404;

Can send Error or Status codes to clientCan send Error or Status codes to clientDeals with CookiesDeals with CookiesDeals with HTTP HeadersDeals with HTTP HeadersCan send HTTP Redirect to clientCan send HTTP Redirect to client



59/127


Servlet Lifecycle: Init()public void init(ServerConfig cfg)public void init(ServerConfig cfg)called once, when servlet loadscalled once, when servlet loads

don't worry about synchronization

perform costly setup here, rather than onceperform costly setup here, rather than onceper requestper request

open database connection(s)

load in persistent dataspawn background threads



60/127


Init Detailsif you fail, throw an UnavailableExceptionif you fail, throw an UnavailableExceptionmust call super.init(cfg), which saves off must call super.init(cfg), which saves off cfgcfg

if you like, you can save it yourself and overridegetServletConfig, but why bother?

Can call getInitParameter(paramName) toCan call getInitParameter(paramName) to

read from the server-side config fileread from the server-side config file



61/127


Servlet Lifecycle: Servicepublic void service(ServletRequest req,public void service(ServletRequest req,

ServletResponse res)ServletResponse res)takes Request and Response objectstakes Request and Response objectscalled many times, once per requestcalled many times, once per request



62/127


service() and ConcurrencyMight be called simultaneously in severalMight be called simultaneously in severalthreadsthreads

it is your responsibility to handle synchronizedaccess to shared resources

It is possible to declare a servlet as single-It is possible to declare a servlet as single-threadedthreaded

implement SingleThreadModel (empty interface) performance will suffer (if there are multiplesimultaneous requests)

You can use class-static data to share data You can use class-static data to share dataacross successive or concurrent requestsacross successive or concurrent requests



63/127


Servlet Lifecycle: Destroypublic void destroy()public void destroy()

takes no parametersyou must clean up

close database connectionsstop threads

Afterwards, servlet may be garbage collected



64/127


Servlet Lifecycle: Destroy DetailsThe server calls destroy after all service calls haveThe server calls destroy after all service calls havebeen completed, or after a certain number of been completed, or after a certain number of seconds have passed, whichever comes first.seconds have passed, whichever comes first.Warning: other threads might be running serviceWarning: other threads might be running service

requests, so be sure to synchronize, and/or waitrequests, so be sure to synchronize, and/or waitfor them to quitfor them to quitSun's Servlet Tutorial has an example of how to do thiswith reference counting

Destroy can not throw an exception, so if Destroy can not throw an exception, so if something bad happens, call log() with a helpfulsomething bad happens, call log() with a helpfulmessage (like the exception)message (like the exception)

See closing a JDBC connection example in Tutorial



65/127


Init ParametersServletConfigServletConfig

String getInitParameter()Enumeration getInitParameterNames()

There are convenience methods of theThere are convenience methods of thesame name inside GenericServletsame name inside GenericServletInit Parameters are set by the server Init Parameters are set by the server

administrator administrator Servlet Parameters are set by the web pageServlet Parameters are set by the web page



66/127


ServletContextcall GenericServlet.getServletContext()call GenericServlet.getServletContext()getServlets()getServlets()

returns list of all installed Servlets

getServlet(String name)getServlet(String name)returns the named Servlet

log()log()see next slide



67/127


LoggingGenericServlet.log(String message)GenericServlet.log(String message)Writes the name of your servlet, plus the message,Writes the name of your servlet, plus the message,to the server log fileto the server log fileLocation of log file is server-specificLocation of log file is server-specific

on JWS, you can check in the Admin Tool"If a servlet will have multiple instances (for example, if the"If a servlet will have multiple instances (for example, if thenetwork service runs the servlet for multiple virtual hosts),network service runs the servlet for multiple virtual hosts),the servlet writer should override this method. Thethe servlet writer should override this method. Thespecialized method should log an instance identifier, along specialized method should log an instance identifier, along

with the requested message." - Javadoc for GenericServlet with the requested message." - Javadoc for GenericServlet But usually, there is only one instance of eachservlet, called reentrantly by the web server



68/127


Servlet.getServletInfo() You should override this method You should override this methodReturns a string containing author, version,Returns a string containing author, version,copyright, etc.copyright, etc.



69/127




70/127


HTTP Servlet Efficiency



71/127


Efficiency: KeepAliveHTTP keepalive improves performanceHTTP keepalive improves performanceKeeps connection alive across multiple HTTPKeeps connection alive across multiple HTTPrequestsrequestsServlet must set content-lengthServlet must set content-length

You can write to a ByteArray or StringBuffer, then You can write to a ByteArray or StringBuffer, thenget its length before writing itget its length before writing itres.setContentLength(sb.length());out.print(sb);

KeepAlive should be enabled by default if all youKeepAlive should be enabled by default if all youdo is write short strings, then close the outputdo is write short strings, then close the outputstreamstream

but maybe not



72/127


Efficiency: getLastModifiedlong HttpServlet.getLastModified(long HttpServlet.getLastModified(HttpServletRequest req )HttpServletRequest req )Returns the time the requested entity wasReturns the time the requested entity waslast modifiedlast modified

difference in milliseconds between that time andmidnight, January 1, 1970negative = unknown (or dynamic)

Improves performance on browser/proxyImproves performance on browser/proxycachingcaching


73/127


Section IV

Saving StateSaving State



74/127


Saving State: WhyShopping CartShopping CartUser PreferencesUser PreferencesWizard interfacesWizard interfaces

i.e., successive linked dialog boxes / form entry pages



75/127


Saving State: HowClient-side storageClient-side storage

Hidden fieldsURL Rewriting

CookiesServer-side storageServer-side storage

Instance variables

Database AccessJWS Session ManagementJWS Session Management

Best possible solution (but still flawed)



76/127


Hidden FieldsSave data inside the servlet, keyed to aSave data inside the servlet, keyed to ahandlehandleStore a handle inside each successiveStore a handle inside each successiveFORMFORMUse that handle to retrieve data each queryUse that handle to retrieve data each queryOf course, you could always store all theOf course, you could always store all the

data in hidden fields, insteaddata in hidden fields, instead



77/127


Hidden Fields: Exampleprivate Dictionary cache = new Hashtable();public void doGet(...) {

String handle = getParameter(handle);

UserData data;if (handle == null) {data = new UserData();handle = makeNewHandle(); // defined

elsewherecache.put( handle, data );

}else

data = (UserData)cache.get(handle);



78/127


Hidden Fields: Exampleout.println();out.println(

);

out.println( ... rest of form ... );



79/127


Hidden Fields: ExampleSurvey.javaSurvey.java



80/127


Hidden Fields: Pros and ConsProsPros

Well understoodYou have control

Can use your own caching mechanism



81/127


Hidden Fields: Pros and ConsConsCons

Need to use FORMshidden fields do not persist across normal links

Sessions are not persistent across server restartsunless you write code to do it

Sessions do not expireunless you write code to do it



82/127


URL RewritingChange HREF and ACTION URLs on the flyChange HREF and ACTION URLs on the flyChange /servlet/catalog intoChange /servlet/catalog into/servlet/catalog?user=1234/servlet/catalog?user=1234



83/127


URL RewritingPro:Pro:

Dont need to use FORMs

ConConLose user if he/she travels outside your web site

Need to use Servlet for all accesses -- cant access araw HTML page



84/127


Using Instance Variables for State

Session data stored in instance variablesSession data stored in instance variablesdirectly is bad - not valid for multiple usersindirectly is better - in a hashtable or vector, keyed

off a unique handlePro: Quick, easyPro: Quick, easyCon: Not persistent, memory can fill upCon: Not persistent, memory can fill up

easilyeasily



85/127


Database StateSession data stored in a databaseSession data stored in a database

You should open a connection to the You should open a connection to thedatabase in your init() method, and close itdatabase in your init() method, and close itin your destroy() methodin your destroy() method

You can still use the hidden field technique You can still use the hidden field techniqueWhen you get a handle, you pull in the user When you get a handle, you pull in the user

data via a DB querydata via a DB query



86/127


Database State: Pros and ConsPro:Pro:

persistenthigh capacity

Con:Con:more complicatedhave to write more codestill doesnt automatically expire old sessions



87/127


C is for Cookie

Cookie Monster is a trademark of Childrens Television Workshop



88/127


Whats A Cookie?Client-side storageClient-side storageServer can drop arbitrary data on browser Server can drop arbitrary data on browser Sent back to server on EVERY successiveSent back to server on EVERY successiverequestrequestAutomatically expiresAutomatically expiresCookies should be neither large nor Cookies should be neither large nor numerousnumerous

Browsers should support twenty cookies per host, of at least four kilobytes each



89/127


Cookie Usessave session datasave session datasave handle to session datasave handle to session datastore user preferences for next sessionstore user preferences for next sessionstore user login informationstore user login information

not very secure, but appropriate for someapplications



90/127


Cookies and ServletsServlets can easily use CookiesServlets can easily use CookiesHttpServletRequest.getCookies() methodHttpServletRequest.getCookies() methodHttpServletResponse.addCookie() methodHttpServletResponse.addCookie() methodCookie objectCookie object



91/127


javax.servlet.http.Cookieget/setName()get/setName()get/setValue()get/setValue()AttributesAttributes

Comment, Domain, MaxAge, Path, Secure, Version



92/127


Cookie ExampleCookie Counter ServletCookie Counter Servlet

Counter.java



93/127


Cookie Pros and ConsPro:Pro:

No server-side storage requirementsSurvive server restarts

Automatically expireCon:Con:

Not supported by all browsersBandwidth limitations

Not good for large amount of dataUser can disable them



94/127


Detecting Cookie AcceptanceCookieDetector.javaCookieDetector.javaDrops a cookie on the clientDrops a cookie on the clientSends a redirect back to CookieDetector,Sends a redirect back to CookieDetector,

with a flag saying this is the test phasewith a flag saying this is the test phaseThe test phase detects whether The test phase detects whether

The client accepted the cookieThe client rejected the cookie (or the browser doesnt support cookies)

Sends another redirect to appropriate pageSends another redirect to appropriate pageYou can tell the user pretty please here



95/127


JWS Session ManagementFlexibleFlexibleLightweightLightweightGeneralGeneralAutomaticAutomaticUses cookies if it can, URL rewriting if itUses cookies if it can, URL rewriting if itcantcantBased on technology from ATGBased on technology from ATG



96/127


Session ObjectsServer-sideServer-sideOne per client (not one per servlet)One per client (not one per servlet)Preserved automaticallyPreserved automatically

even in browsers that dont support cookiesExpire after 30 minutes (by default)Expire after 30 minutes (by default)Saved to disk if server dies; restored if Saved to disk if server dies; restored if server restartsserver restartsLoosely speaking, a session correspondsLoosely speaking, a session correspondsto a single sitting of a single anonymousto a single sitting of a single anonymoususer - JWS Tutorialuser - JWS Tutorial



97/127


Using SessionsHttpSession session = request.getSession

(true);String info =

(String)session.getValue(foo.info);// assume getNewInfo defined elsewhereString newinfo = getNewInfo();

session.putValue(foo.info, newinfo);// then output page



98/127


URL RewritingPreserves sessions on non-cookie browsersPreserves sessions on non-cookie browsersChangesChanges

intointo

You must actively call You must actively call res.encodeUrl(/store/catalog)see next slide

Does not work if user merely disables cookiesDoes not work if user merely disables cookiesHas to actually BE a non-cookie browser Lame



99/127


HttpServletResponse - EncodingHas methods to process URLs to splice in the session ID if Has methods to process URLs to splice in the session ID if appropriateappropriateNot the same as URLEncode / URLDecodeNot the same as URLEncode / URLDecode

the server deals with that

String encodeUrl(String url)String encodeUrl(String url)rewrites the given URL if necessaryif the browser supports cookies, returns URL unchangedAll URLs emitted by a session-using Servlet should be run throughthis method

e.g.e.g.out.println("");

also String encodeRedirectUrl(String url)also String encodeRedirectUrl(String url)



100/127


Session PersistenceSessions swap to diskSessions swap to disk

When server shuts downWhen memory fills up

Uses Java SerializationUses Java Serialization

Only works for Serializable or Externalizableobjects

Note: Session persistence is intended toNote: Session persistence is intended tobe used as a means for preservingbe used as a means for preservingSessions across server restarts. It is notSessions across server restarts. It is notmeant to be used as a general long-termmeant to be used as a general long-termsession persistence mechanism.session persistence mechanism.



101/127


ExampleVectorSessionServlet.javaVectorSessionServlet.java



102/127


BugsCant use custom classes inside sessionCant use custom classes inside sessiondatadataDoesnt really detect whether clientDoesnt really detect whether clientsupports cookiessupports cookies

Instead, detects whether browser can potentiallysupport cookiesLame - they should use my CookieDetector technique


103/127


Section V

Java Web Server FeaturesJava Web Server Features



104/127


Administration ToolsPlay with Admin ToolPlay with Admin Tool

http://localhost:9090/

Click on a service, click Manage buttonClick on a service, click Manage buttonTo shut down server, click Shut DownTo shut down server, click Shut Down



105/127


Manage ServletsAddAddPropertiesProperties

Load on Startup

UnloadUnload



106/127


Servlet AliasesSpecify a partial URLSpecify a partial URLMap it to a particular servletMap it to a particular servlete.g.e.g.

you want http://foo.com/lunch to execute/servlets/meal?type=lunchset alias = /lunch

set servlet invoked = meal?type=lunch



107/127


Servlet Chains (Filters)specify a comma-separated list of servletsspecify a comma-separated list of servletsthe first servlet gets the user inputthe first servlet gets the user inputeach servlet in turn will get the previouseach servlet in turn will get the previousoutputoutputthe final servlet will return to the user the final servlet will return to the user all servlets in chain must use same ACLall servlets in chain must use same ACL



108/127


HTML TemplatesDefine standard look for all (or some) pagesDefine standard look for all (or some) pagesTemplate ServletTemplate ServletA tag inside template page inserts sectionA tag inside template page inserts sectionfrom original pagefrom original page

Specify which files are templated viaSpecify which files are templated viaServlet Aliases in Admin ToolServlet Aliases in Admin Tool



109/127


Page Compilation (JSP)Embed Java code in static HTML pagesEmbed Java code in static HTML pagesthen compile those pages into individualthen compile those pages into individualJava servlets to create a dynamic web siteJava servlets to create a dynamic web site

Based on JHTML technology from ArtBased on JHTML technology from ArtTechnology Group (http://www.atg.com/)Technology Group (http://www.atg.com/)

Product: Dynamo, a Java Web Application Server



110/127


Session TrackingSee aboveSee above



111/127


Servlet BeansUsing Servlets That are BeansUsing Servlets That are Beans

Changes to config file are instantly updatedServlet itself is persistent across server restarts

instance variables, like counters or caches, are preserved

Calling JavaBeans from ServletsCalling JavaBeans from ServletsInvisible BeansInstalled inside lib subdirectory

Calling JavaBeans in JHTML/JSP FilesCalling JavaBeans in JHTML/JSP Files



112/127


FAQAnswers in the Exercises bookAnswers in the Exercises book

How do I develop using the servlet classes withoutinstalling JDK1.2?Is it the servlets directory or the servlet directoryWhy doesnt my servlet work inside a tag?How do I support both GET and POST protocolfrom the same Servlet?How do I fully shut down the server?My browser says the server returned an invalid or unrecognized response what gives?



113/127


ReferencesJava Server 1.1Java Server 1.1

http://java.sun.com/javastore/jserv/buy_try.htmlhttp://java.sun.com/products/java-server/index.html

be sure to download the JWS documentationThe home for servlets and the Java Web Server.The home for servlets and the Java Web Server.

http://jserv.javasoft.comThe Java Web Server 1.1 is available for trial or purchase.The Java Web Server 1.1 is available for trial or purchase.

http://java.sun.com/javastore/jserv/buy_try.htmlThe Java Web Server 1.1.1 upgrade pack is available for free.The Java Web Server 1.1.1 upgrade pack is available for free.

http://java.sun.com/products/java-server/webserver/jws111.html

The Java Server Pages preview pack is available for free.The Java Server Pages preview pack is available for free.http://developer.javasoft.com/developer/earlyAccess/jws- preview.html



114/127


ReferencesRFC2045 - MIMERFC2045 - MIME

http://info.internet.isi.edu/in-notes/rfc/files/rfc2045.txt

RFC 2109 - CookiesRFC 2109 - Cookies

http://info.internet.isi.edu/in-notes/rfc/files/rfc2109.txtLive SoftwareLive Software

http://www.livesoftware.com/JRun, many commercial servlets

ATG - Dynamo Web Application Server ATG - Dynamo Web Application Server http://www.atg.com/



115/127


ReferencesAdvanced Web TechnologiesAdvanced Web Technologies

http://www.javatrain.com/

Purple TechnologyPurple Technologyhttp://www.purpletech.com/

GamelanGamelanhttp://java.developer.com/



116/127


Appendix: CGI Tutorial



117/127


What Is CGI?Common Gateway InterfaceCommon Gateway InterfaceAllows web pages to send parameters toAllows web pages to send parameters toweb server web server

Use HTML forms on client sideUse HTML forms on client sideCan also use Java it's just a protocol!

Use scripts on server sideUse scripts on server side

Can use Servlets!



118/127


Example CGI HTMLName:
Message:



119/127


CGI FlowBrowser downloads HTML page containingBrowser downloads HTML page containingFORM tagFORM tagBrowser lays out input widgetsBrowser lays out input widgets

User fills out form and clicks "Submit"User fills out form and clicks "Submit"Browser takes parameters and sends themBrowser takes parameters and sends themin CGI formatin CGI format



120/127


CGI Flow (Cont.)Server receives parameters and sendsServer receives parameters and sendsthem to CGI scriptthem to CGI scriptCGI script returns MIME documentCGI script returns MIME document

usually it's "text/html"can be any MIME type

Browser receives response document andBrowser receives response document and

displays itdisplays itIf response contains FORM tag, whole thingIf response contains FORM tag, whole thingcan happen againcan happen again



121/127


The FORM tagOpens a formOpens a formACTIONACTION

the URL of the script to execute

METHODMETHODGET or POSTUsually use POST

closed with closed with



122/127


INPUT TYPE=textSpecifies a text fieldSpecifies a text fieldNAMENAME

names parameter to be passed to script

VALUE (optional)VALUE (optional)initial value for text



123/127


INPUT TYPE=textareaSpecifies a multi-line text areaSpecifies a multi-line text areaNAMENAME




124/127


INPUT TYPE=checkboxSpecifies a check box (duh)Specifies a check box (duh)NAMENAME


ISCHECKED=trueISCHECKED=truedefault value on



125/127


INPUT TYPE=radioSpecifies a radio button (or groupedSpecifies a radio button (or groupedcheckbox)checkbox)NAMENAME

names group of buttonsVALUEVALUE

specifies the value for the groupe.g.e.g.

MaleFemale



126/127


INPUT TYPE=submitA push button that submits the formA push button that submits the formNAMENAME

specifies name of variable

VALUEVALUEspecifies name of buttonyes, "value" specifies the name

hey, I didn't write the spec



127/127

INPUT TYPE=resetA push button that clears the formA push button that clears the formDoes not submit itDoes not submit it

7735978-Servlets and the Java Web Server

Documents

Transcript of 7735978-Servlets and the Java Web Server