Unit-4: Servlet Sessions:

Transcription

1 4.1 What Is Session Tracking? Unit-4: Servlet Sessions: Session tracking is the capability of a server to maintain the current state of a single client s sequential requests. Session simply means a particular interval of time. Session Tracking is a way to maintain state of a user. The HTTP protocol used by Web servers is stateless. Each time user requests to the server, server treats the request as the new request. So we need to maintain the state of a user to recognize to particular user. This type of stateless transaction is not a problem unless you need to know the sequence of actions a client has performed while at your site. For example, an online video store must be able to determine each visitor s sequence of actions. Suppose a customer goes to your site to order a movie. The first thing he does is look at the available titles. When he has found the title he is interested in, he makes his selection. The problem now is determining who made the selection. Because each one of the client s requests is independent of the previous requests, you have no idea who actually made the final selection. Note: You could use HTTP authentication as a method of session tracking, but each of your customers would need an account on your site. This is fine for some businesses, but would be a hassle for a high-volume site. You probably could not get every user who simply wants to browse through the available videos to open an account. Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 1

2 Why use Session Tracking? To recognize the user. Session Tracking Techniques There are four techniques used in Session tracking: Cookies Hidden Form Field URL Rewriting HttpSession 4.2 Cookies A cookie is a small piece of information that is persisted between the multiple client requests. A cookie has a name, a single value, and optional attributes such as a comment, path and domain qualifiers, a maximum age, and a version number. javax.servlet.http.cookie class provides the functionality of using cookies. Constructor of Cookie class Cookie(String name, String value): Constructs a cookie with a specified name and value. Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 2

3 Commonly used methods of Cookie class There are given some commonly used methods of the Cookie class. 1. public void setmaxage(int expiry): Sets the maximum age of the cookie in seconds. 2. public String getname(): Returns the name of the cookie. The name cannot be changed after creation. 3. public String getvalue(): Returns the value of the cookie. Other methods required for using Cookies For adding cookie or getting the value from the cookie, we need some methods provided by other interfaces. They are: 1. public void addcookie(cookie ck): method of HttpServletResponse interface is used to add cookie in response object. 2. public Cookie[] getcookies(): method of HttpServletRequest interface is used to return all the cookies from the browser. Advantage of Cookies: 1. Simplest technique of maintaining the state. 2. Cookies are maintained at client side. Disadvantage of Cookies 1. It will not work if cookie is disabled from the browser. 2. Only textual information can be set in Cookie object. Lecturer: Syed Khutubuddin Ahmed Contact: Page 3

4 Example of using Cookies In this example, we are storing the name of the user in the cookie object and accessing it in another servlet. As we know well that session corresponds to the particular user. So if you access it from too many browsers with different values, you will get the different value. Index.html: <form action="firstservlet" method="post"> Name:<input type="text" name="username"/><br/> <input type="submit" value="go"/> </form> Lecturer: Syed Khutubuddin Ahmed Contact: Page 4

5 FirstServlet.java: import javax.servlet.http.*; public class FirstServlet extends HttpServlet { public void dopost(httpservletrequest request, HttpServletResponse response){ try{ response.setcontenttype("text/html"); PrintWriter out = response.getwriter(); String n=request.getparameter("username"); out.print("welcome "+n); Cookie ck=new Cookie("uname",n);//creating cookie object response.addcookie(ck);//adding cookie in the response //creating submit button out.print("<form action='secondservlet' method='post'>"); out.print("<input type='submit' value='go'>"); out.print("</form>"); out.close(); catch(exception e){system.out.println(e); SecondServlet.java: import javax.servlet.http.*; public class SecondServlet extends HttpServlet { public void dopost(httpservletrequest request, HttpServletResponse response){ try{ PrintWriter out = response.getwriter(); Cookie ck[]=request.getcookies(); out.print("hello "+ck[0].getvalue()); out.close(); catch(exception e){system.out.println(e); Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 5

6 4.3 Filter A filter is an object that is used to perform filtering tasks such as conversion, log maintain, compression, encryption and decryption, input validation etc. A filter is invoked at the preprocessing and post processing of a request. It is pluggable, i.e. its entry is defined in the web.xml file, if we remove the entry of filter from the web.xml file, filter will be removed automatically and we don't need to change the servlet. So it will be easier to maintain the web application. Usage of Filter: recording all incoming requests logs the IP addresses of the computers from which the requests originate conversion data compression encryption and decryption Input validation etc. Advantage of Filter Filter is pluggable. One filter doesn t have dependency onto another resource. Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 6

7 4.3.1 Filter API A filter is an object that is used to perform filtering tasks such as conversion, log maintain, compression, encryption and decryption, input validation etc. Like servlet filter have its own API. The javax.servlet package contains the three interfaces of Filter API Filter FilterChain Filter interface For creating any filter, you must implement the Filter interface. Filter interface provides the life cycle methods for a filter. 1. public void init(filterconfig config): init() method is invoked only once it is used to initialize the filter. 2. public void dofilter (HttpServletRequest request,httpserv!etresponse response, FilterChain chain): dofilter() method is invoked every time when user request to any resource, to which the filter is mapped.it is used to perform filtering tasks. 3. public void destroy(): This is invoked only once when filter is taken out of the service FilterChain interface The object of Filter Chain is responsible to invoke the next filter or resource in the chain. This object is passed in the dofilter method of Filter interface. The Filter Chain interface contains only one method: public void dofilter(httpservletrequest request, HttpServletResponse response): It passes the control to the next filter or resource. Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 7

8 4.3.4 How to define Filter We can define filter same as servlet. Let's see the elements of filter and filter-mapping. <web-app> <filter> <filter-name>...</filter-name> <filter- class>...</filter- class > </filter> <filter-mapping> <filter-name>...</filter-name> <url-pattern>...</url-pattern> </filter-mapping > </web-app> For mapping filter we can use, either url-pattern or servlet-name. The url-pattern element has an advantage over servlet-name element i.e. it can be applied on servlet, JSP or HTML Authentication Filter We can perform authentication in filter. Here, we are going to check to password given by the user in filter class, if given password is admin, it will forward the request to the WelcomeAdmin servlet otherwise it will display error message. Example of authenticating user using filter Let's see the simple example of authenticating user using filter. Here, we have created 4 files: o index.html o MyFilter.java o AdminServlet.java o web.xml index.html <form action="servlet1"> Name:<input type="text" name="name"/><br/> Password:<input type="password" name="password"/><br/> <input type="submit" value="login"> </form> Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 8

9 AdminServlet.java import javax.servlet.http.*; public class AdminServlet extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); PrintWriter out = response.getwriter(); out.print("welcome ADMIN"); out.close(); MyFilter.java public class MyFilter implements Filter{ public void init(filterconfig arg0) throws ServletException { public void dofilter(servletrequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException { PrintWriter out=resp.getwriter(); String password=req.getparameter("password"); if(password.equals("admin")){ chain.dofilter(req, resp);//sends request to next resource else{ out.print("username or password error!"); RequestDispatcher rd=req.getrequestdispatcher("index.html"); rd.include(req, resp); public void destroy() { Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 9

10 web.xml <servlet> <servlet-name>adminservlet</servlet-name> <servlet-class>adminservlet</servlet-class> </servlet> <servlet-mapping> <servlet-name>adminservlet</servlet-name> <url-pattern>/servlet1</url-pattern> </servlet-mapping> <filter> <filter-name>f1</filter-name> <filter-class>myfilter</filter-class> </filter> <filter-mapping> <filter-name>f1</filter-name> <url-pattern>/servlet1</url-pattern> </filter-mapping> </web-app> 4.4 Multi-tier Applications Using Database Connectivity A simple web application which connects to the database and inserts data into database Welcome.html <html> <body> <form action="databaseservlet"> <p>enter Name: <input type="text" name="sname" size="20"></p> <p>enter Branch: <input type="text" name="branch" size="20"></p> <p><input type="submit" value="submit ></p> </form> </body> </html> Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 10

11 DatabaseServlet.java: package Servlet; import java.sql.*; import javax.servlet.http.*; public class DatabaseServlet extends HttpServlet { public void doget(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); PrintWriter pw = response.getwriter(); String url="jdbc:odbc:mydatasource"; Connection con; try { String name = request.getparameter("sname"); String branch = request.getparameter("branch"); pw.println(ename); pw.println(branch); Class.forName("sun.jdbc.odbc.JdbcOdbcDriver"); con = DriverManager.getConnection(url, scott, tiger ); PreparedStatement pst = con.preparestatement("insert into student values(?,?)"); pst.setstring(1, name); pst.setstring(2,branch); int i = pst.executeupdate(); if(i!=0){ pw.println("<br>record has been inserted"); else { pw.println("failed to insert the data"); catch (Exception e){ pw.println(e); Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 11

12 Example of Login Form in Servlet Here, we are going to create the simple example to create the login form using servlet. We have used oracle10g as the database. There are 5 files required for this application. 1) index.html 2) FirstServlet.java 3) LoginDao.java 4) SecondServlet.java 5) web.xml You must need to create a table userreg with name and pass fields. Moreover, it must have contained some data. The table should be as: index.html Create table userreg(name varchar2(40) pass varchar2(40)); <form action="servletr method="post"> Name:<input type="text" name="username7><br/><br/> Password:<dnput type="password' name='userpass7><br/><br/> <input type="submif value='login"/> </form> FirstServlet.java import javax.servlet.http.*; public class FirstServlet extends HttpServlet { public void dopost(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); PrintWriter out = response.getwriter(); String n=request.getparameter("username"); String p=request.getparameter("userpass"); if(logindao.validate(n, p)){ RequestDispatcher rd=request.getrequestdispatcher("welcomeservlet"); rd.forward(request,response); else{ out.print("sorry username or password error"); RequestDispatcher rd=request.getrequestdispatcher("index.html"); Lecturer: Syed Khutubuddin rd.include(request,response); Ahmed Contact: khutub27@gmail.com Page 12

13 Login.java import java.sql.*; public class LoginDao { public static boolean validate(string name, String pass){ boolean status=false; try{ Class.forName("sun.jdbc.odbc.JdbcOdbcDriver"); Connection con=drivermanager.getconnection("jdbc:odbc:mydatasource","system","oracle"); PreparedStatement ps=con.preparestatement("select * from userreg where name=? and pass=?"); ps.setstring(1,name); ps.setstring(2,pass); ResultSet rs=ps.executequery(); status=rs.next(); catch(exception e){ System.out.println(e); return status; WelcomeServlet.java import javax.servlet.http.*; public class WelcomeServlet extends HttpServlet { public void dopost(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html"); PrintWriter out = response.getwriter(); String n=request.getparameter("username"); out.print("welcome "+n); out.close(); Lecturer: Syed Khutubuddin Ahmed Contact: khutub27@gmail.com Page 13