Internet Technologies 6 - Servlets I. F. Ricci 2010/2011

Transcription

1 Internet Technologies 6 - Servlets I F. Ricci 2010/2011

2 Content Basic Servlets Tomcat Servlets lifecycle Servlets and forms Reading parameters Filtering text from HTML-specific characters Reading headers Sending compressed content Differentiating among browsers Referer Most of the slides were made available by www. coreservlets.com

3 Servlet Roles Read the explicit data sent by the client Read the implicit HTTP request data sent by the browser Generate the results Send the explicit data (i.e., the document) to the client Send the implicit HTTP response data

4 HelloWorld import java.io.*; import javax.servlet.*; import javax.servlet.http.*; /** Very simplistic servlet that generates plain text. * <P> * Taken from More Servlets and JavaServer Pages * from Prentice Hall and Sun Microsystems Press, * * 2002 Marty Hall; may be freely used or adapted. */ public class HelloWorld extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { PrintWriter out = response.getwriter(); out.println("hello World"); code

5 Servlet Architecture HTTP Request HTTP Response Servlet Container Java Virtual Machine (JVM) Servlet 1 Servlet 2 Client Web Web Server Servlet n

6 Installing and Running Tomcat Tomcat is distributed as a ZIP archive tomcat.apache.org unzip the download file, for instance into a rootlevel directory: C:\apache-tomcat To run Tomcat you'll need to tell it where to find your J2SE SDK installation Set the JAVA_HOME environment variable to C:\Program Files\Java\jdk1.6.0_04 To run Tomcat: open a command window change directory to Tomcat's bin directory Type startup

7 Tomcat Directory Structure Tomcat binaries: startup, shutdown All jar libraries: e.g. servlet-api.jar Configuration files: e.g. when you build your application in Netbeans a new file is added to indicate where is deployed (e.g., C:\apachetomcat \conf \Catalina\localhost \coresjsp.xml) Directories of the web applications deployed here, possibly generated by.war files deployed here (with a web.xml file)

8 Catalina Base Go to netbeans: tools>servers to look at these details

9 web.xml <?xml version="1.0" encoding="iso "?> <!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" " <web-app> <servlet> <servlet-name>bob</servlet-name> <servlet-class>helloworld</servlet-class> </servlet> <servlet-mapping> <servlet-name>bob</servlet-name> <url-pattern>/helloworld</url-pattern> </servlet-mapping> </web-app>

10 Compiling and deploying Create a directory in \webapps called hello Create a directory in \webapps\hello called WEB-INF and then a subdirectory classes where to put the sources and the compiled files Set the classpath C:\>set CLASSPATH=\apache-tomcat \common \lib\servlet-api.jar Compile C:\>javac HelloWorld.java Deploy the web.xml file in C:\apachetomcat \webapps\hello\WEB-INF Or use an IDE (Netbeans) separating sources (web directory) and deployment (build directory).

11 Starting Tomcat /bin/startup.bat or startup.sh Point Browers to should see default page All the Docs are there on the default page! Check out the examples pages, good tutorials

12 Basic Servlet Structure Here's the outline of a basic servlet that handles GET and POST requests in the same way: import java.io.*; import javax.servlet.*; import javax.servlet.http.*; public class SomeServlet extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { PrintWriter out = response.getwriter(); // Use "out" to send content to browser public void dopost(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { doget(request, response);

13 HelloWorld HTML import java.io.*; import javax.servlet.*; import javax.servlet.http.*; public class HelloServlet2 extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); PrintWriter out = response.getwriter(); String doctype = "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.0 " + "Transitional//EN\">\n"; out.println(doctype + "<HTML>\n" + "<HEAD><TITLE>Hello (2)</TITLE></HEAD>\n" + "<BODY BGCOLOR=\"#FDF5E6\">\n" + "<H1>Hello</H1>\n" + "</BODY></HTML>"); code

14 Some Simple HTML-Building Utilities public class ServletUtilities { public static final String DOCTYPE = "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.0 " + "Transitional//EN\">"; public static String headwithtitle(string title) { return(doctype + "\n" + "<HTML>\n" + "<HEAD><TITLE>" + title + "</TITLE></HEAD>\n");... Don t go overboard Complete HTML generation packages usually work poorly The JSP framework is a better solution code

15 HelloServlet3: Packages and Utilities package coreservlets; import java.io.*; import javax.servlet.*; import javax.servlet.http.*; public class HelloServlet3 extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); PrintWriter out = response.getwriter(); String title = "Hello (3)"; out.println(servletutilities.headwithtitle(title)+ "<BODY BGCOLOR=\"#FDF5E6\">\n" + "<H1>" + title + "</H1>\n" + "</BODY></HTML>"); code

16 The Servlet Life Cycle (Servlet Interface) init Executed once when the servlet is first loaded Not called for each request service Called in a new thread by server for each request Dispatches to doget, dopost, etc. Do not override this method! doget, dopost, doxxx Handles GET, POST, etc. requests Override these to provide desired behavior destroy Called when server deletes servlet instance Not called after each request. javadoc

17 Example of usage of init If a servlet get a request for a url with the http header if-modified-since: Mon, 12 Nov :00:00 GMT It can check if something has really changed the output after that date if not the servlet sends back a reply: HTTP/ Not Modified And the browser shows the cashed url The servlet must only implement the following method to know when it has been modified the last time: public long getlastmodified(httpservletrequest request) The app server will call it when a client requests the servlet And will send back a result only if the page was modified (according to the value returned by the method) after Mon, 12 Nov :00:00 GMT

18 Code The init method set the time the page was modified public void init() throws ServletException { // Round to nearest second (i.e, 1000 milliseconds) modtime = System.currentTimeMillis()/1000*1000; for(int i=0; i<numbers.length; i++) { numbers[i] = randomnum(); An then overwrite the method that tells when the page was modified public long getlastmodified(httpservletrequest request) { return(modtime); LotteryNumbers code

19 Calls to the servlet The page was modified after 8:00:00 GMT The page was not modified after 9:00:00 GMT

20 Calls to the servlet You can do the same experiments with a telnet connection (e.g., using putty)

21 HTML Form <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD><TITLE>A Sample Form Using GET</TITLE></HEAD> <BODY> <H2 ALIGN="CENTER">A Sample Form Using GET</H2> <FORM ACTION=" <CENTER> First name: <INPUT TYPE="TEXT" NAME="FirstName" VALUE=""><BR/> Last name: <INPUT TYPE="TEXT" NAME="LastName" VALUE=""><P> <INPUT TYPE="SUBMIT"> </CENTER> </FORM> </BODY> </HTML> form

22 Reading form data in servlets request.getparameter( FirstName") Returns URL-decoded value of first occurrence of FirstName parameter in query string Works identically for GET and POST requests Returns null if no such parameter is in query data request.getparametervalues( FirstName") Returns an array of the URL-decoded values of all occurrences of FirstName parameter in query string Returns a one-element array if param is not repeated Returns null if no such parameter is in the query request.getparameternames() or request.getparametermap() Returns Enumeration or Map of request parameters Usually reserved for debugging.

23 Reading parameters import java.io.*; import javax.servlet.*; import javax.servlet.http.*; import java.util.*; public class ServletForm extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); PrintWriter out = response.getwriter(); out.println("<!doctype HTML PUBLIC \"-//W3C//DTD HTML 4.0 Transitional//EN\">" + "<HTML>\n" + "<HEAD><TITLE>ServletForm</TITLE></HEAD>\n" + "<BODY BGCOLOR=\"#FDF5E6\">\n" + "<H1 ALIGN=\"CENTER\">ServletForm</H1>\n" + "<UL>\n" + "<LI><B>FirstName</B>: "+ request.getparameter("firstname")+"\n"+ "<LI><B>LastName</B>: "+ request.getparameter("lastname")+"\n"+ "</UL>\n" + "</BODY></HTML>"); public void dopost(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { doget(request, response); ServletForm code

24 Example: reading all parameters getform postform

25 Reading All Parameters public class ShowParameters extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); PrintWriter out = response.getwriter(); String doctype = "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.0 " + "Transitional//EN\">\n"; String title = "Reading All Request Parameters"; out.println(doctype + "<HTML>\n" + "<HEAD><TITLE>"+title + "</TITLE></HEAD>\n"+ "<BODY BGCOLOR=\"#FDF5E6\">\n" + "<H1 ALIGN=CENTER>" + title + "</H1>\n" + "<TABLE BORDER=1 ALIGN=CENTER>\n" + "<TR BGCOLOR=\"#FFAD00\">\n" + "<TH>Parameter Name<TH>Parameter Value(s)"); code

26 Reading All Parameters Enumeration paramnames = request.getparameternames(); while(paramnames.hasmoreelements()) { String paramname = (String)paramNames.nextElement(); out.print("<tr><td>" + paramname + "\n<td>"); String[] paramvalues = request.getparametervalues(paramname); if (paramvalues.length == 1) { String paramvalue = paramvalues[0]; if (paramvalue.length() == 0) out.println("<i>no Value</I>"); else out.println(paramvalue); else { out.println("<ul>"); for(int i=0; i<paramvalues.length; i++) { out.println("<li>" + paramvalues[i]); out.println("</ul>"); out.println("</table>\n</body></html>");

27 Reading All Parameters public void dopost(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { doget(request, response);

28 Filtering Strings for HTML-Specific Chars You cannot safely insert arbitrary strings into servlet output < and > can cause problems anywhere & and " can cause problems inside of HTML attributes You sometimes cannot manually translate The string is derived from a program excerpt or another source where it is already in some standard format The string is derived from HTML form data Failing to filter special characters from form data makes you vulnerable to cross-site scripting attack.

29 Filtering Strings for HTML-Specific Chars public class ServletUtilities { public static String filter(string input) { if (!hasspecialchars(input)) { return(input); StringBuffer filtered = new StringBuffer(input.length()); char c; for(int i=0; i<input.length(); i++) { c = input.charat(i); switch(c) { case '<': filtered.append("<"); break; case '>': filtered.append(">"); break; case '"': filtered.append("""); break; case '&': filtered.append("&"); break; default: filtered.append(c); return(filtered.tostring()); code

30 No Filtering public class BadCodeServlet extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { out.println(doctype + "<HTML>\n" + "<HEAD><TITLE>"+title+"</TITLE></HEAD>\n" + "<BODY BGCOLOR=\"#FDF5E6\">\n" + "<H1 ALIGN=\"CENTER\">" + title + "</H1>\n"+ "<PRE>\n" + getcode(request) + "</PRE>\n" + "Now, wasn't that an interesting sample\n" + "of code?\n" + "</BODY></HTML>"); protected String getcode(httpservletrequest request) { return(request.getparameter("code")); Spaces and line breaks are preserved code

31 Special Chars: no filtering form calling the badservlet

32 Servlet that does Filtering public class GoodCodeServlet extends BadCodeServlet { protected String getcode(httpservletrequest request) { return (ServletUtilities.filter(super.getCode(request))); //get the code as in the super class and then do the filter code

33 Filtering goodservlet

34 A Typical HTTP Request GET /servlet/search?keywords=servlets+jsp HTTP/1.1 Accept: image/gif, image/jpg, */* Accept-Encoding: gzip Connection: Keep-Alive Cookie: userid=id Host: Referer: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) You need to understand HTTP to be effective with servlets and JSP

35 Reading Request Headers General methods of the HttpServletRequest getheader(string name) the first one with that name getheaders(string name) all occurrences of the header getheadernames Specialized methods of the HttpServletRequest getcookies getauthtype and getremoteuser getcontentlength getcontenttype getdateheader getintheader Related info getmethod, getrequesturi, getquerystring, getprotocol

36 Checking For Missing Headers HTTP 1.0 All request headers are optional HTTP 1.1 Only Host is required Conclusion Always check that request.getheader is non-null before trying to use it String val = request.getheader("some- Name"); if (val!= null) {

37 All Request Headers (Firefox) Call servlet

38 Request Headers (Internet Explorer)

39 Making a Table of Request Headers public class ShowRequestHeaders extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { out.println (doctype + "<HTML>\n" + "<HEAD><TITLE>"+title+"</TITLE></HEAD>\n"+ "<BODY BGCOLOR=\"#FDF5E6\">\n" + "<H1 ALIGN=\"CENTER\">" + title + "</H1>\n" + "<B>Request Method: </B>" + request.getmethod() + "<BR>\n" + "<B>Request URI: </B>" + request.getrequesturi() + "<BR>\n" + "<B>Request Protocol: </B>" + request.getprotocol() + "<BR><BR>\n" + code

40 Request Headers (Continued) "<TABLE BORDER=1 ALIGN=\"CENTER\">\n" + "<TR BGCOLOR=\"#FFAD00\">\n" + "<TH>Header Name<TH>Header Value"); Enumeration headernames = request.getheadernames(); while(headernames.hasmoreelements()) { String headername = (String)headerNames.nextElement(); out.println("<tr><td>" + headername); out.println(" <TD>"+request.getHeader(headerName)); out.println("</table>\n</body></html>"); /** Since this servlet is for debugging, have it * handle GET and POST identically. */ public void dopost(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { doget(request, response);

41 Common HTTP 1.1 Request Headers Accept Indicates MIME types browser can handle Can send different content to different clients. For example, PNG files have good compression characteristics but are not widely supported in browsers. A servlet could check to see if PNG is supported, sending <IMG SRC="picture.png"...> if it is supported, and <IMG SRC="picture.gif"...> if not. Accept-Encoding Indicates encodings (e.g., gzip or compress) browser can handle. See following example

42 Common HTTP 1.1 Request Headers Authorization User identification for password-protected pages Instead of HTTP authorization, use HTML forms to send username/password and store info in session object - this approach is usually preferable because standard HTTP authorization results in a small, terse dialog box that is unfamiliar to many users Servers have high-level way to set up password-protected pages without explicit programming in the servlets.

43 Common HTTP 1.1 Request Headers Connection In HTTP 1.0, keep-alive means browser can handle persistent connection - in HTTP 1.1, persistent connection is default Persistent connections mean that the web server can reuse the same socket over again for requests very close together from the same client (e.g., the images associated with a page, or cells within a framed page). Servlets can't do this unilaterally; the best they can do is to give the web server enough info to permit persistent connections - they should set Content-Length response header.

44 Common HTTP 1.1 Request Headers Cookie Gives cookies previously sent to client Use getcookies, not getheader (we shall do that in a next lecture) Host Indicates host given in original URL This is a required header in HTTP 1.1 This fact is important to know if you write a custom HTTP client (e.g., WebClient we used before) or telnet to a server and use the HTTP/1.1 version.

45 Common HTTP 1.1 Request Headers If-Modified-Since Indicates client wants page only if it has been changed after specified date Don t handle this situation directly; implement getlastmodified instead See lottery-number example we have already shown Referer URL of referring Web page Useful for tracking traffic; logged by many servers Can also be used to let users set preferences and then return to the page they came from Can be easily spoofed; don't let this header be sole means of deciding how much to pay sites that show your banner ads Some browsers (Opera), ad filters (Web Washer), and personal firewalls (Norton) screen out this header.

46 Common HTTP 1.1 Request Headers User-Agent Best used for identifying category of client Web browser vs. I-mode cell phone, etc. For Web applications, use other parameters if possible Again, can be easily spoofed We shall touch this later

47 Sending Compressed Web Pages Dilbert used with permission of United Syndicates Inc.

48 Sending Compressed Pages: GzipUtilities.java public class GzipUtilities { public static boolean isgzipsupported (HttpServletRequest request) { String encodings = request.getheader("accept-encoding"); return((encodings!= null) && (encodings.indexof("gzip")!= -1)); public static boolean isgzipdisabled (HttpServletRequest request) { String flag = request.getparameter("disablegzip"); return((flag!= null)&& // if the parameter is not null (!flag.equalsignorecase("false"))); // and not "false" public static PrintWriter getgzipwriter (HttpServletResponse response) throws IOException { return(new PrintWriter (new GZIPOutputStream (response.getoutputstream()))); code

49 Sending Compressed Pages: LongServlet.java public class LongServlet extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); // Change the definition of "out" depending on // whether or not gzip is supported. PrintWriter out; if (GzipUtilities.isGzipSupported(request) &&!GzipUtilities.isGzipDisabled(request)) { out = GzipUtilities.getGzipWriter(response); response.setheader("content-encoding", "gzip"); else { out = response.getwriter(); code

50 Sending Compressed Pages: LongServlet.java out.println (doctype + "<HTML>\n" + "<HEAD><TITLE>" + title + "</TITLE></HEAD>\n" + "<BODY BGCOLOR=\"#FDF5E6\">\n" + "<H1 ALIGN=\"CENTER\">" + title + "</H1>\n"); String line = "Blah, blah, blah, blah, blah. " + "Yadda, yadda, yadda, yadda."; for(int i=0; i<10000; i++) { out.println(line); out.println("</body></html>"); out.close();

51 Sending Compressed Pages: Results Uncompressed (28.8K modem), Firefox, Netscape and Internet Explorer: > 50 seconds Compressed (28.8K modem), Firefox, Netscape and Internet Explorer: < 5 seconds Caution: be careful about generalizing benchmarks call call

52 Differentiating Among Different Browser Types Use User-Agent only when necessary Otherwise, you will have difficult-to-maintain code that consists of tables of browser versions and associated capabilities Check for null The header is not required by the HTTP 1.1 specification, some browsers let you disable it (e.g., Opera), and custom clients (e.g., Web spiders or link verifiers) might not use the header at all To differentiate among Firefox, Netscape, and Internet Explorer, check for MSIE, not Mozilla Both Firefox and Internet Explorer say Mozilla at the beginning of the header Note that the header can be faked If a client fakes this header, the servlet cannot tell the difference.

53 Differentiating Among Different Browser Types public class BrowserInsult extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); PrintWriter out = response.getwriter(); String title, message; // Assume for simplicity that Firefox and IE are // the only two browsers. String useragent = request.getheader("user-agent"); if ((useragent!= null) && (useragent.indexof("msie")!= -1)) { title = "Microsoft Minion"; message = "Welcome, O spineless slave to the " + "mighty empire."; else { title = "Hopeless Firefox Rebel"; message = "Enjoy it while you can. " + "You <I>will</I> be assimilated!"; code

54 Differentiating Among Browser Types (Result) call

55 Referer The Referer header designates the location of the page users were on when they clicked on a link No Referer is set if the user typed the address of the page You can customize a page depending on how the user reached it Customize the layout of a page according to the site that link to Change the content if the user come from the same domain or another domain Supply a link to go back Track the effectiveness of a banner or a link.