Advanced Java Class Web Applications Part 1 (Servlets) Named vs. - PowerPoint PPT Presentation

Advanced Java Class Web Applications – Part 1 (Servlets)

Named vs. Anonymous Servlets • Anonymous Syntax: http://hostname/MyApp/ servlet/myapp.servlets. MyServlet • Named Syntax: http://hostname/MyApp /Myservlet in web.xml: <servlet> <servlet-name> MyServlet </servlet-name> <servlet-class>myapp.servlets.MyServlet</servlet-class> </servlet> < servlet-mapping> <servlet-name> MyServlet </servlet-name> <url-pattern> /MyServlet </url-pattern> </servlet-mapping> advantages of named: user friendly, more secure •

Servlet API • HttpServlet – Your Servlets must extend this class • HttpServletRequest – Interface type of object sent to Servlet • HttpSession Useful for storing user session data – • HttpServletResponse – Interface type of object sent to Servlet

HttpServlet • doGet(HttpServletRequest req, HttpServletResponse resp) – [send page to user] • doPost(HttpServletRequest req, HttpServletResponse resp) – [process user input]

HttpServletRequest • HttpSession getSession() • String getParameter(String name) • java.util.Map getParameterMap() • Object getAttribute(String name) • void setAttribute(String name)

HttpSession • Object getAttribute(String name) • setAttribute(String name, Object value)

Processing HTML Forms • in HTML page < form method=post – action="/SkiClub/LoginServlet"> < input type="text" name="LNAME" – value=""> • in Servlet – doPost method implemented Call getParameter("LNAME") to find what – they want to login as

HTTP Response options • write HTML as text into the Output Stream • forward request to another resource in web app: HTML, JSP, Servlet, etc. • Redirect request to any web resource • Return an error

HttpServletResponse • ServletOutputStream getOutputStream(); RequestDispatcher rd = • request.getRequestDispatcher(“[resource we’re forwarding request to]”); rd.forward(request, response); void sendRedirect(String location); • • void sendError(int sc, String msg);

Servlet filtering • Encryption • to use : implement Filter interface, and write doFilter method, initialize with FilterConfig • Can make subclasses of HttpRequest & HttpResponse for special behavior

Web App Continuity • Problem: Http protocol is inherently stateless, but often a web app requires a "conversation", which has state. • Solutions: – Storing Data on Server side • Request Session • • Application • DB – Storing Data on Client side Cookies • • URL Rewriting • Hidden form fields

Storing Data on Server side; available scopes • Request scope [HttpRequest] – good for a forward to a JSP page or another servlet • Session scope [HttpSession] – good for session-long variables, like 'username‘ Application scope - getServletContext() • global for all servlets & clients – • DB scope – permanent

Storing Data in HttpSessions • Attributes may be stored in sessions - so long as they are serializable. There should be one session per client browser • session. • Sessions reside on the server. They are not passed to the client. Instead, a cookie stored on the client machine tells the – server which session belongs to which client browser. • Knowing when to end a session is tricky, but usually you want them to time out after a period of inactivity. You want the session to remain active as long as the user is "using" the site.

Storing Data on Client side • Cookies (permanent, but may be disabled) • URL rewriting (use if cookies are disabled) • Hidden form fields (temporary)

Cookies • Name-value string pairs • Last beyond one session Stored on the client side, tagged with IP • address that they came from. • When client sends request, it includes all the cookies from the IP that it's contacting. • HttpServletResponse.addCookie(String name, String value); • Cookie[] HttpServletRequest.getCookies(); No security involved! Be careful. •

URL Rewriting • What if cookies are disabled on the client machine? • These methods put the cookie info into the URL if cookies are disabled. String HttpServletResponse.encodeURL(String url) – – String HttpServletResponse.encodeRedirectURL(String url) • Encoded with an easy to decrypt algorithm - still not secure.

Hidden form fields • HTML Syntax: – <input type="hidden" name="formID" value=TA45"/> • Not user modifiable • Not secure - visible in view source • Client side storage area to pass data to servlet

Digital Flashcards Example Activity 1. What is the highest scope at which each the following values should be stored? – username of currently logged in user – Quiz word for the next page – list of valid user names and passwords – Number of words correct in current quiz – History of correctness for this word