Beyond Java Servlet ProgramingBeyond Java Servlet Programing

O'Reilly Conference on JavaO'Reilly Conference on Java

March, 2000March, 2000

Copyright 2000, K&A SoftwareCopyright 2000, K&A Software

IntroductionsIntroductions

Jason HunterJason Hunter

jasonh@kasoftware.comjasonh@kasoftware.com

K&A SoftwareK&A Software

http://www.kasoftware.comhttp://www.kasoftware.com

http://www.servlets.comhttp://www.servlets.com

Author of Author of

"Java Servlet Programming""Java Servlet Programming"

(O'Reilly)(O'Reilly)

OverviewOverview

• This talk will:This talk will:– Explain the history of servletsExplain the history of servlets– Describe in detail what's new in API 2.2Describe in detail what's new in API 2.2– Introduce the exciting new Web Application Introduce the exciting new Web Application

conceptconcept– Show how to use deployment descriptorsShow how to use deployment descriptors– Explain the new rules for distributed appsExplain the new rules for distributed apps– Describe how to control response bufferingDescribe how to control response buffering– Show the new header manipulation methodsShow the new header manipulation methods– Demonstrate new internationalization supportDemonstrate new internationalization support– Explain the new role-based security mechanismExplain the new role-based security mechanism– Talk about Project JakartaTalk about Project Jakarta

• If you want an introduction to servlets, THIS IS NOT IT!If you want an introduction to servlets, THIS IS NOT IT!

Servlet TimelineServlet Timeline

• December 1996December 1996– JavaSoft Servlets first introduced (Java Web Server)JavaSoft Servlets first introduced (Java Web Server)

• June 1997June 1997– Servlet API 1.0 finalized (JSDK 1.0)Servlet API 1.0 finalized (JSDK 1.0)

• December 1997December 1997– Servlet API 2.0 introduced (JWS 1.1)Servlet API 2.0 introduced (JWS 1.1)

• April 1998April 1998– Servlet API 2.0 finalized (JSDK 2.0)Servlet API 2.0 finalized (JSDK 2.0)

• November 1998November 1998– Servlet API 2.1 introduced (specification)Servlet API 2.1 introduced (specification)

• April 1999April 1999– Servlet API 2.1 finalized (JSDK 2.1)Servlet API 2.1 finalized (JSDK 2.1)

• August 1999August 1999– Servlet API 2.2 introduced (specification)Servlet API 2.2 introduced (specification)

• December 1999December 1999– Servlet API 2.2 finalized (Jakarta)Servlet API 2.2 finalized (Jakarta)

Differences From 1.0 to 2.1Differences From 1.0 to 2.1

• Differences between 1.0 and 2.0Differences between 1.0 and 2.0– Support for internationalizationSupport for internationalization– Support for cookiesSupport for cookies– Support for built-in session trackingSupport for built-in session tracking– New SingleThreadModel interfaceNew SingleThreadModel interface– Support for HTTP/1.1Support for HTTP/1.1

• Differences between 2.0 and 2.1Differences between 2.0 and 2.1– The API was been "cleaned up"The API was been "cleaned up"– Support for request dispatchingSupport for request dispatching– Support for sharing information via contextsSupport for sharing information via contexts– Support for getting resources in an abstract waySupport for getting resources in an abstract way– More control over session managementMore control over session management– First release of a specification!First release of a specification!

Differences From 2.1 to 2.2Differences From 2.1 to 2.2

• Differences between 2.1 and 2.2Differences between 2.1 and 2.2– Servlets are now part of J2EEServlets are now part of J2EE– Introduced notion of pluggable Web applicationsIntroduced notion of pluggable Web applications– Clarified rules for back-end server distributionClarified rules for back-end server distribution– Added response output bufferingAdded response output buffering– Enhanced control over HTTP headersEnhanced control over HTTP headers– Gave new ways to do request dispatchingGave new ways to do request dispatching– Provided advanced error handlingProvided advanced error handling– Several method signatures have been changed for Several method signatures have been changed for

consistencyconsistency

Servlets in J2EEServlets in J2EE

• The servlet API is now a required API of the The servlet API is now a required API of the Java 2 Java 2 Platform, Enterprise EditionPlatform, Enterprise Edition (J2EE, jatooee) (J2EE, jatooee)

• No real effect to servlet developersNo real effect to servlet developers– Except "servlet engine" has become "servlet Except "servlet engine" has become "servlet

container"container"

• Enterprise developers are guaranteed support for Enterprise developers are guaranteed support for servlets along with the other enterprise APIsservlets along with the other enterprise APIs– Lucky developers!Lucky developers!

Web ApplicationsWeb Applications

• Web Applications may change the way the Web works.Web Applications may change the way the Web works.– A collection of servlets, JavaServer Pages (JSPs), A collection of servlets, JavaServer Pages (JSPs),

HTML documents, images, and other Web HTML documents, images, and other Web resources resources

– Portably deployable across any servlet-enabled Portably deployable across any servlet-enabled Web serverWeb server

– Simple install, with full configuration information in Simple install, with full configuration information in the web appthe web app

– Plug in a search engine, guestbook app, store Plug in a search engine, guestbook app, store front, etcfront, etc

• Web apps can be deployed using a single archive fileWeb apps can be deployed using a single archive file– Have file extension Have file extension .war.war– Stands for "Web application archive"Stands for "Web application archive"– Created using "jar" toolCreated using "jar" tool– Can be digitally signedCan be digitally signed

This is WARThis is WAR

• Inside a war you might find these files:Inside a war you might find these files:

• On install, a war is mapped to a URI prefix on the On install, a war is mapped to a URI prefix on the serverserver– Assume this war is assigned prefix Assume this war is assigned prefix /demo/demo– /demo/index.html/demo/index.html serves serves index.htmlindex.html– /demo/servlet/CorpServlet/demo/servlet/CorpServlet serves serves

CorpServletCorpServlet

index.html feedback.jsp images/banner.gif WEB-INF/web.xml WEB-INF/lib/jspbean.jar WEB-INF/classes/CorpServlet.class WEB-INF/classes/com/corp/db/SupportClass.class

Inside WEB-INFInside WEB-INF

• WEB-INFWEB-INF contains classes and configuration info contains classes and configuration info – Modeled after Modeled after META-INFMETA-INF in JARs in JARs– Content is not served directly to the clientContent is not served directly to the client– WEB-INF/classesWEB-INF/classes contains servlets and contains servlets and

supporting class filessupporting class files– WEB-INF/libWEB-INF/lib contains JAR files, automatically contains JAR files, automatically

searchedsearched– WEB-INF/web.xmlWEB-INF/web.xml is a deployment descriptor is a deployment descriptor

• The deployment descriptor contains app configuration The deployment descriptor contains app configuration infoinfo– It's an XML file with a DTD specified in the Servlet It's an XML file with a DTD specified in the Servlet

specificationspecification

The web.xml FileThe web.xml File

• The web.xml deployment descriptor DTD contains over The web.xml deployment descriptor DTD contains over 50 tags to specify:50 tags to specify:

Graphical icon files for the application Graphical icon files for the application – For GUI manipulationFor GUI manipulation

A description of the app A description of the app – What the app does, who wrote it, where it can be What the app does, who wrote it, where it can be

foundfound

A flag indicating whether or not the app can be A flag indicating whether or not the app can be distributed distributed – Distributed apps can be spread across multiple Distributed apps can be spread across multiple

back-end servers, must follow stricter rules than back-end servers, must follow stricter rules than non-distributed appsnon-distributed apps

Parameter information for the app Parameter information for the app – Essentially app-level init parametersEssentially app-level init parameters

The web.xml File, Cont'dThe web.xml File, Cont'd

Registered servlet names Registered servlet names – A place to register servlets and give them namesA place to register servlets and give them names

Servlet init parameters Servlet init parameters – Alter servlet behavior via paramsAlter servlet behavior via params

Servlet load order Servlet load order – Which servlets are preloaded, and in what order. Which servlets are preloaded, and in what order.

URL mapping rules URL mapping rules – Standardized mappings from URLs to servletsStandardized mappings from URLs to servlets– Can be explicit (/foo.html), prefix-based (/lite/*), or Can be explicit (/foo.html), prefix-based (/lite/*), or

extension-based (*.jsp)extension-based (*.jsp)

Session timeout defaults Session timeout defaults – How many minutes of client inactivity before a How many minutes of client inactivity before a

timeouttimeout

File extension to MIME type mappings File extension to MIME type mappings – Say .java should be served as text/plainSay .java should be served as text/plain

The web.xml File, Cont'dThe web.xml File, Cont'd

A welcome file list A welcome file list – An ordered list of files to serve by default An ordered list of files to serve by default

((index.jspindex.jsp, , index.htmlindex.html, , index.htmindex.htm))

Error-handling rules Error-handling rules – Custom handling for error codes or exceptionsCustom handling for error codes or exceptions

References to external data sources, such as JNDI References to external data sources, such as JNDI – Add resources into the JNDI lookup tableAdd resources into the JNDI lookup table

Security constraints Security constraints – Dictate which pages must be protected, and howDictate which pages must be protected, and how– Includes built-in form-based authenticationIncludes built-in form-based authentication

• For the full DTD see For the full DTD see http://java.sun.com/j2ee/dtds/web-app_1_2.dtdhttp://java.sun.com/j2ee/dtds/web-app_1_2.dtd

Web Apps: A Programmer's ViewWeb Apps: A Programmer's View

• To a programmer, a web app corresponds to one To a programmer, a web app corresponds to one ServletContextServletContext object object– All servers have at least a default contextAll servers have at least a default context– Shared app data can go in the context using Shared app data can go in the context using

setAttribute()setAttribute() and and getAttribute()getAttribute()– Each context also has separate Each context also has separate HttpSessionHttpSession data data

• Web app parameters are available using Web app parameters are available using context.getInitParameter(String name)context.getInitParameter(String name)

• The URI prefix can be retrieved with The URI prefix can be retrieved with req.getContextPath()req.getContextPath()– Returns "Returns "/demo/demo" or "" for default" or "" for default

• Make sure not to use the URI prefix with Make sure not to use the URI prefix with getRequestDispatcher()getRequestDispatcher() and and getResource()getResource()– To do so would limit portabilityTo do so would limit portability

Context Method ExampleContext Method Example

• Remember, this code won't compile on most of today's Remember, this code won't compile on most of today's servers.servers.

public void doGet(..., ...) throws ... { res.setContentType("text/plain"); PrintWriter out = res.getWriter();

out.println("My context path is: " + req.getContextPath());

out.println("My context parameters are:"); ServletContext context = getServletContext(); Enumeration e = context.getInitParameterNames(); while (e.hasMoreElements()) { String name = (String) e.nextElement(); Object value = context.getInitParameter(name); out.println(name + ": " + value); }

RequestDispatcher dispatcher = context.getRequestDispatcher("/servlet/BuyNow"); dispatcher.include(req, res); }

Lifecycle ClarificationsLifecycle Clarifications

• Newly defined: There's exactly one servlet instance Newly defined: There's exactly one servlet instance per definition (registered name) per context.per definition (registered name) per context.– Allows instance variables to hold state informationAllows instance variables to hold state information– Servlets did this before, now it's guaranteed to Servlets did this before, now it's guaranteed to

workwork

• Also defined: Servlets sharing information via their Also defined: Servlets sharing information via their context must not experience any unexpected context must not experience any unexpected ClassCastExceptionClassCastException– Thrown when same class is loaded by different Thrown when same class is loaded by different

class loadersclass loaders– So now any servlet reload may cause a full context So now any servlet reload may cause a full context

reloadreload

Distributed ApplicationsDistributed Applications

• Mark an app "distributable" using the deployment Mark an app "distributable" using the deployment descriptordescriptor

• A distributed app must put only A distributed app must put only SerializableSerializable objects in user sessionsobjects in user sessions– Supports the server moving data between serversSupports the server moving data between servers– Server may throw Server may throw IllegalArgumentExceptionIllegalArgumentException

if the stored object is not if the stored object is not SerializableSerializable– Servers use session affinity for efficiencyServers use session affinity for efficiency– (So requests from a particular user are handled by (So requests from a particular user are handled by

one JVM at a time)one JVM at a time)

• A distributed app must use external resources A distributed app must use external resources (database, EJB) to share app information(database, EJB) to share app information– There's one There's one ServletContextServletContext instance per JVM instance per JVM– Information placed into the context is not Information placed into the context is not

transferredtransferred

Response BufferingResponse Buffering

• In 2.2, servlets can control response bufferingIn 2.2, servlets can control response buffering– Previously servers had control over bufferingPreviously servers had control over buffering– Most had buffers around 8KMost had buffers around 8K– Now servlets can specify the minimum buffer Now servlets can specify the minimum buffer

requiredrequired

• This allows flexibility in error handlingThis allows flexibility in error handling– In HTTP the status code (indication of error) must In HTTP the status code (indication of error) must

come firstcome first– Impossible to set once response has been Impossible to set once response has been

"committed" with data sent"committed" with data sent– Larger buffers allow more output to be written Larger buffers allow more output to be written

before commitbefore commit

Response Buffering MethodsResponse Buffering Methods

• void setBufferSize(int size)void setBufferSize(int size)– Specifies minimum buffer size in bytesSpecifies minimum buffer size in bytes

– Server may use a larger buffer than requestedServer may use a larger buffer than requested

– Set before writing output!Set before writing output!

• int getBufferSize()int getBufferSize()– Returns actual buffer sizeReturns actual buffer size

• boolean isCommitted()boolean isCommitted()– Returns if response is committedReturns if response is committed

• void reset()void reset()– Empty buffer and unset headersEmpty buffer and unset headers

– Called by Called by sendError()sendError() and and sendRedirect()sendRedirect()

• void flushBuffer()void flushBuffer()– Sends buffer contents and commitsSends buffer contents and commits

A Response Buffer ExampleA Response Buffer Example

• This servlet demonstrates response buffering in action.This servlet demonstrates response buffering in action.

public void doGet(..., ...) throws ... { res.setBufferSize(16 * 1024); // 16K buffer res.setContentType("text/html"); PrintWriter out = res.getWriter();

// returns 16384 or greater int size = res.getBufferSize();

out.println("The client won't see this"); res.reset(); out.println("Nor will the client see this!"); res.reset(); out.println("Nor this if sendError() is called"); if (req.getParameter("important") == null) { res.sendError(400, "important param needed"); }}

Support for Double HeadersSupport for Double Headers

• A servlet can now retrieve and set multiple headers of A servlet can now retrieve and set multiple headers of the same name.the same name.

• Enumeration getHeaders(String name)Enumeration getHeaders(String name)– Returns multiple values for a given header as Returns multiple values for a given header as

Enumeration of String objectsEnumeration of String objects– Useful for headers like Useful for headers like Accept-LanguageAccept-Language

• void addHeader(String name, String value)void addHeader(String name, String value)– Adds another value for the given headerAdds another value for the given header– Unlike Unlike setHeader()setHeader() which replaces previous values which replaces previous values– Also Also addIntHeader()addIntHeader() and and addDateHeader()addDateHeader()

Accept-Language: en Accept-Language: fr Accept-Language: ja

Now This Is Just TemporaryNow This Is Just Temporary

• Servlets often need to write temporary filesServlets often need to write temporary files– There's now a standard locationThere's now a standard location– Each context has a separate directoryEach context has a separate directory– Attribute Attribute "javax.servlet.context.tempdir""javax.servlet.context.tempdir"

// The directory is given as a File object File dir = (File) getServletContext().getAttribute( "javax.servlet.context.tempdir");

// Make temp file in temp dir (JDK 1.2) File f = File.createTempFile("xxx", ".tmp", dir);

// Prepare to write to the file FileOutputStream fout = new FileOutputStream(f);

// ...

No More AmnesiaNo More Amnesia

• Previously servlets had no way to determine their own Previously servlets had no way to determine their own name!name!

• The name is now available using The name is now available using getServletName()getServletName()– This helps servlets store state informationThis helps servlets store state information– Using the name as part of the lookup key keeps Using the name as part of the lookup key keeps

data unique per instancedata unique per instance

public void doGet(..., ...) throws ... { // Inherited from GenericServlet String name = getServletName();

ServletContext context = getServletContext(); Object value = context.getAttribute(name + ".state");}

So, Where Are You From?So, Where Are You From?

• More internationalization (i18n) support has been More internationalization (i18n) support has been added in 2.2.added in 2.2.

• Locale req.getLocale()Locale req.getLocale()– Returns the client's most preferred locale, based Returns the client's most preferred locale, based

primarily on the primarily on the Accept-LanguageAccept-Language header header

• Enumeration req.getLocales()Enumeration req.getLocales()– Returns all the client's preferred localesReturns all the client's preferred locales

• void res.setLocale(Locale loc)void res.setLocale(Locale loc)– Specifies the locale of the responseSpecifies the locale of the response– Automatically sets the Automatically sets the Content-LanguageContent-Language and and

Content-TypeContent-Type appropriately appropriately– Call this method after calling Call this method after calling setContentType()setContentType(), ,

before before getWriter()getWriter()

Locales in ActionLocales in Action

• This servlet demonstrates the new i18n support:This servlet demonstrates the new i18n support:

• Note this isn't as powerful as Note this isn't as powerful as com.oreilly.servlet.LocaleNegotiatorcom.oreilly.servlet.LocaleNegotiator – See See http://www.servlets.com/resourceshttp://www.servlets.com/resources

public void doGet(..., ...) {

res.setContentType("text/html"); Locale loc = req.getLocale(); res.setLocale(loc); PrintWriter out = res.getWriter();

// Write output based on loc.getLanguage()}

Servlet SecurityServlet Security

• A deployment descriptor can set up portable security A deployment descriptor can set up portable security constraintsconstraints– Security is role-basedSecurity is role-based– Certain pages can be viewed by users that are part Certain pages can be viewed by users that are part

of a given roleof a given role– For example, only managers can view salary For example, only managers can view salary

informationinformation

• The deployment descriptor specifies the access The deployment descriptor specifies the access granted to each rolegranted to each role– Role to user or role to group mappings are done Role to user or role to group mappings are done

during deploymentduring deployment– Server-specific tools facilitate thisServer-specific tools facilitate this– Users may come from the server, OS, database, Users may come from the server, OS, database,

and so onand so on

Servlet Security MethodsServlet Security Methods

• Two methods were added to support role-based securityTwo methods were added to support role-based security

• java.security.Principaljava.security.Principal

req.getUserPrincipal()req.getUserPrincipal()– Returns a Returns a PrincipalPrincipal with the name of the client user with the name of the client user– Returns Returns nullnull if the user hasn't logged in if the user hasn't logged in

• boolean req.isUserInRole(String role)boolean req.isUserInRole(String role)– Returns true if the current user belongs to the Returns true if the current user belongs to the

specified rolespecified role

• boolean req.isSecure()boolean req.isSecure()– Returns true if the request was made over a secure Returns true if the request was made over a secure

channel (HTTPS)channel (HTTPS)

Servlet Security ExampleServlet Security Example

• This example snoops the current security information.This example snoops the current security information.

public void doGet(..., ...) { res.setContentType("text/plain"); PrintWriter out = res.getWriter();

out.println("The current user is: " + req.getUserPrincipal()); out.println("Is the user a Manager? " + req.isUserInRole("Manager")); out.println("Is our connection secure? " + req.isSecure());}

Better DispatchingBetter Dispatching

• API 2.2 has more convenient request dispatching.API 2.2 has more convenient request dispatching.

• RequestDispatcher RequestDispatcher context.getNamedDispatcher(String name)context.getNamedDispatcher(String name)– Lets a servlet dispatch to a component specified by Lets a servlet dispatch to a component specified by

name instead of URI pathname instead of URI path• Lets components stay "private"Lets components stay "private"

• RequestDispatcher RequestDispatcher req.getRequestDispatcher(String path)req.getRequestDispatcher(String path)– Lets a user specify a Lets a user specify a relativerelative URL target URL target– The The context.getRequestDispatcher()context.getRequestDispatcher()

method must be absolutemethod must be absolute– No need for that method anymoreNo need for that method anymore

Better RedirectingBetter Redirecting

• Finally, API 2.2 also makes it more convenient to do Finally, API 2.2 also makes it more convenient to do simple redirects.simple redirects.

• void res.sendRedirect(String url)void res.sendRedirect(String url)– The redirect URL can now be relativeThe redirect URL can now be relative– Clients still demand absolute URLs so the server Clients still demand absolute URLs so the server

does translation before sending!does translation before sending!

SummarySummary

• To summarize…To summarize…

– Java Servlet API 2.2 makes servlets part of a Java Servlet API 2.2 makes servlets part of a complete Web application frameworkcomplete Web application framework

– Whole subsections of Web sites can be easily Whole subsections of Web sites can be easily deployed on any Web server that supports API 2.2deployed on any Web server that supports API 2.2

– Servlets have solid rules for distribution across Servlets have solid rules for distribution across multiple back-end serversmultiple back-end servers

– Response buffering has been added to make error Response buffering has been added to make error handling more robusthandling more robust

– HTTP header control has been improvedHTTP header control has been improved– Request dispatching has been made easier with Request dispatching has been made easier with

support for relative paths and named dispatcherssupport for relative paths and named dispatchers