Construction d Applications Réparties / Master MIAGE

Transcription

1 Construction d Applications Réparties / Master MIAGE HTTP and Servlets Giuseppe Lipari CRiSTAL, Université de Lille February 24, 2016

2 Outline HTTP HTML forms Common Gateway Interface Servlets

3 Outline HTTP HTML forms Common Gateway Interface Servlets

4 The browser A web-brower is a generic client that can do several things Request and show static html documents (web-pages) together with images, audio and video CSS is used to present a document in one specific way Send data (through forms) using the POST command Execute scripts (e.g. Javascript) Execute java applets Therefore, one possible way of implementing a distributed system is to use the browser as Rich-Client Platform (RCP) In this case, programming client side is a mixture of HTML, CSS, Javascript (and maybe Flash or Java applets)

5 The server A classic web server (e.g. Apache, IIS, etc.) implements basic services like retrieving a html file, together with images and other A/V files However it is possible to extend these basic functionalities by implementing additional services using appropriate scripting languages (PHP, JSP, etc.) running external programs (CGI-bin, Servlets, etc.) Advantages: reuse of existing code increased portability (thanks to HTTP/HTML, etc.) uniform presentation Disadvantages not all browsers adhere to the same standards more difficult to program distributed systems with state (it depends on the platform)

6 Basic functioning 1, 2: establish TCP connection 3: get method demanding an HTML file 4: send the HTML file The client requests the additional files (CSS, images, etc.)

7 Commands Two main commands GET for getting files / resources (Server -> Client) POST for uploading information (Client -> Server) When you visit a web page, you normally use GET When you compile a form, or when you upload a file, you use POST

8 Authentication HTTP uses the Basic Authentication Stateless: the credentials must be sent at every request Credentials are login/password in the header The server responds with HTTP/ Unauthorized WWW-Authenticate: basic realm="apps" The Client sends a new request with GET /somedir/somefile.html HTTP/1.1 User-agent:... Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l The string "login:password" is coded using the RFC2045-MIME variant of Base64

9 Caching The client can store copies of the files if the file has not changed, the server does not need to send it The client sends the header field If-modified-since: <date> If the server has a newer copy, it sends a normal response, otherwise it sends HTTP/ Not Modified A Proxy is a local server used as a "closer copy" of the remote server it is useful to reduce network congestion it can be used in the presence of firewalls

10 Stateful communication HTTP is stateless if we want to maintain some state, we have to send the state information in every message Various methods Cookies Hidden form fields

11 Cookies A cookie is a string value, generated by the server, that the browser can store and send in the following messages

12 Cookies There are various types of cookies Session cookies do not have an expiration date. They are usually deleted by the browser when it is closed, so they are usually tied to the "session". Permanent cookies have an expiration date, that can be very long, so they persist after the user closes the browser sometimes called tracking cookies because they can be used to record the browsing history

13 Cookie domain Every cookie is associated to a domain Normally, a cookie s domain attribute will match the domain that is shown in the web browser s address bar (first-party cookie) Third-party cookies, however, belong to domains different from the one shown in the address bar Example: The user visits which contains an advertising banner belonging to ad.foxytracking.com which sets a third-party cookie When the user later visits which also contains a banner from the same advertiser, the banner can read the previous cookie and build the history From wikipedia: "As of 2014, some websites were setting cookies readable for over 100 third-party domains. On average, a single website was setting 10 cookies, with a maximum number of cookies (first- and third-party) reaching over 800."

14 Cookie attributes A cookie is identified by A name, a value, and several attributes Example: Request: GET /index.html HTTP/1.1 Host: Response: HTTP/ OK Content-type: text/html Set-Cookie: theme=light Set-Cookie: sessiontoken=abc123; Expires=Wed, 09 Jun :18:14 GMT Next Request: GET /spec.html HTTP/1.1 Host: Cookie: theme=light; sessiontoken=abc123

15 Cookie attributes The Domain and Path attributes define the scope of the cookie. For obvious security reasons, cookies can only be set on the current resource s top domain and its sub domains If a cookie s domain and path are not specified by the server, they default to the domain and path of the resource that was requested (but not the subdomains) The Expires attribute defines a specific date and time for when the browser should delete the cookie. The date/time is specified in the form Wdy, DD Mon YYYY HH:MM:SS GMT Alternatively, the Max-Age attribute can be used to set the cookie s expiration as an interval of seconds in the future, relative to the time the browser received the cookie The Secure attribute is meant to keep cookie communication limited to encrypted transmission The HttpOnly attribute directs browsers not to expose cookies through channels other than HTTP (and HTTPS)

16 Outline HTTP HTML forms Common Gateway Interface Servlets

17 Forms A HTML form may contain: text areas (for input of long texts) buttons checkboxes radio buttons menus The client can enter data and then send it to the server by clicking on the final "submit" button

18 Example of HTML form <html><body> <form action=" method="post"> <p>name <input name="client" size="46"/></p> <p>street <input name="street" size="40"/></p> <p>city <input name="city" size="20"/> Postal code <input name="cp" size="5"/></p> <p>credit card number <input name="carte" size="10"/> Expiration date <input name="expire" type="text" size="4"/></p> <p>mastercard <input name="cc" type="radio" value="mc" checked/> VISA <input name="cc" type="radio" value="visa"/></p> <p><input type="submit" value="submit"/> <input type="reset" value="reset"/></p> </form> </body></html>

19 Submission When the user press the "Submit" button the browser builds a string containing pairs field = value the pairs are separated by character & spaces are encoded as + characters + & = are encoded as %2B %26 %3D Example client=jean+vier&rue=54+rue+gambetta&ville=paris& cp=75001&carte= &cc=vis The string is sent in the message body part of a HTTP POST method

20 Submitting a file <html> <body> <form action=" method="post" enctype="multipart/form-data"> <p>password <input name="passe" size="16" type="password"/> </p> <p>select a file <input name="fichier" type="file"/> </p> <p><input type=submit value="submit"/> <input type=reset value="reset"/> </p> </form></body> </html> Header Content-Type: multipart/form-data; boundary= d225420d803c8 Body d225420d803c8 Content-Disposition: form-data; name="image.gif"; filename="..." Content-Type: image/gif GIF89a&... binary content d225420d803c8

21 Hidden field It is possible to hide a field that contains a certain value <input name="cache" value="gl" type="hidden"> This can be used by some server to keep state between successive requests the field value is sent to the server with the next "submit" action for example, the value of the hidden field may contain an user-id generated by the server, or other stateful information <html> <body> <form action=" method="post"> Hidden field <input name="hdn" value="gl " type="hidden"/><br/> <input value="click" onclick="functionjavascript()" type="button"/><br/> <input type="submit" value="send"/> <input type="reset" value="reset"/><br/> </form> </body> </html>

22 Hidden field protocol Similar to a cookie, an hidden field can be used to maintain state between successive requests 1. The server sends a form containing an hidden field (which identifies the user/session) 2. The user fills in the form and clicks on the "Submit" button 3. The browser sends a POST request containing the value of the hidden field in the parameter string 4. The server can look up for the value to identify the user/session, and respond appropriately

23 Outline HTTP HTML forms Common Gateway Interface Servlets

24 CGI CGI stands for Common Gateway Interface it is a standard way to execute a generic script or program on the server side for example a program that processes a POST method to process/store the form data a program/script that dynamically generates a web page Any kind of program: bash shell scripts, Perl, Python, exec files, etc. Programs are denoted by a URL by convention, all CGI programs are located in cgi-bin/ For several reasons, this approach is less and less used

25 CGI - passing parameters Either with GET or POST GET, values encoded in the url GET /cgi-bin/anniversaire.pl?mois=aout&jour=11 HTTP/1.0 POST, values encoded in the body POST /cgi-bin/anniversaire.pl HTTP/1.0 Content-type: application/x-www-form-urlencoded Content-length: 20 mois=aout&jour=11 Data passed to CGI via env. variables (GET) CONTENT_TYPE, CONTENT_LENGTH,... SCRIPT_NAME=/cgi-bin/anniversaire.pl QUERY_STRING=mois=aout&jour=11

26 CGI - producing output Example in shell script: echo "content-type: text/html" echo echo "<!doctype html publi\"-//w3c/dtd html 3.2 final/en\">" echo "<html>" echo "<body>" echo "it is <b>" date "</b>" echo "</body>" echo "</html>" In other programming languages, you may use the std output to send the data out

27 Outline HTTP HTML forms Common Gateway Interface Servlets

28 Servlet definition A Servlet is a java program that extends the capabilities of a server it is a very generic, definition A HTTP Servlet is dedicated to HTTP server, and responds to HTTP requests Component based programming The Web server is already written in a generic way, and it implements the complete HTTP protocol For some specific URI, it redirects the request message to a servlet which is in charge of building the response Advantages The programmer is not concerned with implementing the HTTP protocol from scratch Different servlets can coexist in the same server

29 Servlet container The HTTP server must support containers a container is an extension of the server that allows the execution of external code

30 Servlet: basics The bytecode is on the server Every servlet is associated an URL ex: When the server receive a request with path /myservlet/prog, it calls the container to execute the associated servlet The servlet object is created the first time it is executed, then it is reused This means that it can maintain its state across different executions the servlet is executed by a thread (typically, a different thread for every request) pay attention to multi-threading issues! If there is an exception, the error code is sent back to the client by the container

31 Servlet: Java interface A servlet class extends javax.servlet.http.httpservlet It can redefine the method void service(servletrequest request, ServletResponse response); ServletRequest : String getmethod() return the HTTP method (e.g. GET or POST) String getparameter(string param) returns the value of the field param (present into a form) Enumeration getparameternames() returns all parameters names ServletResponse: void setcontenttype(string type) defines the MIME type of the response PrintWriter getwriter() returns an output stream that can be used to produce the HTML file

32 Servlet example The calculator void processrequest(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html;charset=utf-8"); try (PrintWriter out = response.getwriter()) { out.println("<!doctype html>");... out.println("method: " + request.getmethod() + "<br/>"); String q = request.getquerystring(); out.println("query: " + q + "<br>"); tring resp = ""; try { int result = compute(q); resp += "Result : " + result; } catch (ParseError ex) { resp = "Error! Operation unknown"; } out.println(resp + "<br/>"); out.println("</html>"); } }

33 Servlet example class ParseError extends Exception { }; protected int compute(string q) throws ParseError { if (q.contains("*")) { String x[] = q.split("\\*"); return Integer.parseInt(x[0]) * Integer.parseInt(x[1]); } else if (q.contains("+")) { String x[] = q.split("\\+"); return Integer.parseInt(x[0]) + Integer.parseInt(x[1]); } else if (q.contains("+")) { String x[] = q.split("\\-"); return Integer.parseInt(x[0]) - Integer.parseInt(x[1]); } else if (q.contains("/")) { String x[] = q.split("/"); return Integer.parseInt(x[0]) / Integer.parseInt(x[1]); } else throw new ParseError(); }

34 Persistence Let s try to add a counter variable, to see what happens across two invocations int counter = 0; void processrequest(httpservletrequest request, HttpServletResponse response) throws ServletException, IOException { response.setcontenttype("text/html;charset=utf-8"); try (PrintWriter out = response.getwriter()) {... tring resp = ""; try { int result = compute(q); counter++; resp += counter + ") Result : " + result; } catch (ParseError ex) { resp = "Error! Operation unknown"; } out.println(resp + "<br/>"); out.println("</html>"); } }

35 Example result At the third invocation:

36 Services service is called on every request normally, it automatically calls doget() for GET requests, dopost() for POST requests, etc. So, you can also decide to overload such functions instead of service void init(servletconfig c) : automatically called by the container during the loading/starting of the servlet object void destroy() automatically called by the container during the desctruction of the object

37 MIME types We can transfer any type of file back: we set the type with resp.setcontenttype("..."), with text/html image/gif video/mpeg audio/mp3 application/pdf application/octet-stream...

38 Transferring a file public class FichierServlet extends HttpServlet { public void service( HttpServletRequest req, HttpServletResponse resp ) throws ServletException, IOException { resp.setcontenttype("application/octet-stream"); resp.setheader("content-disposition", "attachment;filename=monfichier.ext"); OutputStream os = resp.getoutputstream(); File f = new File("monfichier.ext"); byte [] content = new byte[f.length()]; FileInputStream fis = new FileInputStream(f); fis.read(content); fis.close(); os.write(content); } }

39 HTTP sessions There is no such a thing as a "session" in HTTP However, we can build something similar using a cookie, or a hidden field, etc. Java Servlet abstract this concept by providing the concept of "Session" On a request object, we can do HttpSession session = request.getsession(true) return the current session, or creates a new one is a session does not exist yet. HttpSession session = request.getsession(false) returns the current session, or null if it does not exist yet

40 HTTPSession methods void setattribute(string name, Object value) adds a pair (name, value) valid for this session Object getattribute(string name) return the value associated to the key "name", or null void removeattribute(string name) removes the pair corresponding to the name key Enumeration getattributenames() returns the names of all keys associated to this session void setmaxintervaltime(int seconds) sets the maximum duration of this session (MaxAge) long getcreationtime() / long getlastaccessedtime() returns the creation date / the last access date of this session as a long (convertible to Date)

41 Shared data It may be useful to share data among different servlets To do this, we can use a servlet context ServletContext ctx = getservletcontext() It is a dictionnary of (key,value) pairs, where values can be arbitrary jaba Objects Methods: void setattribute(string name, Object value) Object getattribute(string name) void removeattribute(string name) Enumeration getattributenames()

42 Deploy to install a servlet into a server, we need to prepare a war file Example: like jar, but for web applications jar cf app.war index.html WEB-INF/classes/* Every archive war must contain a WEB-INF/web.xml file that specifies the content and configures the servlets <web-app> <servlet> <servlet-name>helloservlet</servlet-name> <servlet-class>mypackage.helloservlet</servlet-class> </servlet> <servlet-mapping> <servlet-name>helloservlet</servlet-name> <url-pattern>/version/beta/hello</url-pattern> </servlet-mapping> </web-app> URL: