I'm working on a small web application that contains some JSPs, Servlets and static HTML pages. There are also some filters to implement a small authentication/authorization mechanism. My questions are:
How can I map an entire directory of JSPs to another? Here's an example: I want to map all the URLs like localhost:8080/WebAppName/pages/*.jsp to localhost:8080/WebAppName/*.jsp . How can I do that without writing an entry in the web.xml for each JSPs page in the directory 'pages'?
After having mapped these URLs to new ones, what do I have to write in the tag of in the web.xml? The mapped URL (WebAppName/*.jsp) or the real one (WebAppName/pages/*.jsp)?
Thanks in advance.
You could make a servlet - or JSP - that has a mapping *.xhtml (other extension). Using the request URI it can do a dynamic include of the corresponding JSP from pages.
In servlet:
String pagesPath = "pages/" + ...;
request.getServletContext(pagesPath).getRequestDispatcher().include(request,
response);
I doubt it is a good idea, as it does not add something: you might even need to adapt all JSPs (other extension). Or rename the JSPs to .jspf.
In general I use JSPs under WEB-INF/jsp or so; so they are not publicly accessible. And use a similar technique: creating a model in the servlet, and then to the view as JSP.
Related
I'd like to know if anyone has a solution to access resources of a website through a servlet only.
I have all my resources under WEB-INF. In other words, I don't want users to have direct access to any of my resources.
You can use ServletContext#getResource() for that.
URL resource = getServletContext().getResource("/WEB-INF/file.ext");
File file = new File(resource.getPath());
// ...
You can even use ServletContext#getResourceAsStream() to get an InputStream directly:
InputStream input = getServletContext().getResourceAsStream("/WEB-INF/file.ext");
// ...
As you can see in the examples, the ServletContext is available in servlets by the inherited GenericServlet#getServletContext() method.
That said, the phrase I don't want users to have direct access to any of my resources. is a bit contradicting. You're serving those resources by a servlet anyway? A servlet is directly accessible by URL. How is that different from "direct access"? Or do you just want to control the access based on some conditions? I'd say, a Filter is more suitable for this task.
Usually one would only fully hide the JSP files from direct access. In a Servlet which acts as front controller (according the MVC pattern) you could then forward requests to JSP files using RequestDispatcher#forward() which you in turn can obtain by ServletRequest#getRequestDispatcher().
request.getRequestDispatcher("/WEB-INF/page.jsp").forward(request, response);
You can hide jsp from the end user. In fact, you don't even have to deploy original jsp files with your web application, you can precompile them:
http://tomcat.apache.org/tomcat-5.5-doc/jasper-howto.html#Web%20Application%20Compilation
And the only way to hide html/js/css files is not to use them. Anything that's sent to the browser can be viewed there.
How is this achieved, I have everything mapped from / to the dispatcher Servlet and the css is in the webapp folder. when clicking on the css link href in the source I get a tomcat error.
Do I need to create a #RequestMapping for css?
Css are served without the need of dispatcher (unless you configure it to serve css). Just put them in some folder in your webapp dir and reference them as /YourAppContext/path-to-your-css in your pages.
For example in typical (non-maven) webapp it's inside WebContent/css
Assuming your app's context name is MyApp and you want to reference WebContent/css/main.css
you should put something like this in jsp:
<c:url value="/css/main.css" />
or uglier using
/MyApp/css/main.css
as your css url
CSS are client files, not server files. All client files (CSS, Javascript, etc.) have nothing to do with Spring MVC, which acts on servlets (on the server). SO you add your CSS exactly the same way you would if you weren't using Spring MVC.
i want to tell my java servlet to ignore calls for static files, for example, if the file exists - just return the actual file without actually loading the servlet.
in my example i have a MyServlet in netbeans, and under the "web pages" directory i placed image.jpg.
next, i generated a .war file and placed it under tomcat/webapps
when i try to make a request to localhost:8080/MyServlet/image.jpg - the file is not loaded, the servlet is executed instead.
what i want is that if the file exists - it will return it, otherwise will run the servlet.
is there a quick way to implement it?
Mapping your servlet to / or /* is not the standard way for implementing servlets. In general you map global (controller) servlets to a path like /myServlet/*. Tomcat's default servlet is already available to serve your static content. It's configured in <tomcat>/conf/web.xml. Extract from inline documentation:
<!-- The default servlet for all web applications, that serves static -->
<!-- resources. It processes all requests that are not mapped to other -->
<!-- servlets with servlet mappings (defined either here or in your own -->
If you follow the above mentioned approach URLs in your application may look like this:
Static resource: http://myserver/myWAR/images/image.gif
Your servlet's URLs: http://myserver/myWAR/myServlet/* (* := wildcard)
Of course, more complex options like offloading static content to an external web server are available. You can override the standard configuration as well, but in most situations this is not necessary (at least in my experience).
Normally you'd handle this via your servlet mapping or by putting your static resources away from your servlet mapping.
Otherwise, if the request is mapping to your servlet, you either need to (a) check for the file in the servlet, and redirect to the real filename or stream back the image yourself, or (b) write a filter that knows enough about your webapp's structure to see if the request should be handled by your servlet, or the container.
If you described your usecase it'd be easier to be more helpful.
For static files you most likely need just to use http://localhost:8080/image.jpg (i.e. without the MyServlet part in the URL)
I use Jersey for my REST API. I use JSP files for the views. I put my JSP view files in www/views/.... Now I'd like to forbid access to these views through simple HTTP request on their canonical URL.
What is the best way to forbid direct access to these JSPs from the client ?
Stick the JSPs under /WEB-INF in the WAR.
As johna has already said, if you put the .jsp files under WEB-INF this will prevent any access to them from the web directly.
If you want finer-grained security controls I would investigate a tool like Spring Security which will let you set up more complex security rules.
I am new to J2EE and related stuff in general. I am trying to move a particular web application from a Sun One server deployment on to JBoss. The application is filled with a lot of servlets where each one re-directs to another.
There are way too many servlets for me to enter a mapping between each of these servlet class to a URL-mapping individually in web.xml. The application code has many redirects where they name the servlet class names itself in the redirect-URL. As of now when I run it on JBoss the redirections to URL with servlet classnames in URL don't seem to work on JBoss (it gives a 404: Not Found, probably since there is no mapping in the web.xml). So is there any config setting that I can set to allow this to happen or should manually enter each and every URLpattern-to-Servlet mapping in the web.xml?
Thank you.
There are two solutions.
As we know JBoss uses Tomcat under the hood as a servlet container. You can enable invoker servlet, that would save you from mapping the whole lot in web.xml. But beware, it will be naive to do that, and not at all encouraged.
Secondly, you can write another servlet/filter and map just that in your web.xml for every url pattern, may be. Then that new servlet of your can forward the requests to whatever servlet it should.
I hope you get my point.
Not sure what you mean by this
the application code has many redirects where they name the servlet class names itself in the redirect-URL
Do you have hardcoded urls in the servlet classes? How many servlets? If you have hardcoded urls they may all have broken because the context is slightly different, or the appname, etc.etc. Can you post an example?
Well, there are some hard-coded URLs in the code, but even if i typed in the right URLs in browser directly I still get a 404. There are about 30 servlets (a conservative approximation). Ex: http://FQDN_SERVER.com/?arg1=ABCD&arg2=XYZ
Here the servlet-classname is literally the classname of the servlet without ".class" extension, which may not be a good practice. But the code is full of such redirections and if I have to change this then I have to add a new url-pattern to each of these servlets in the web.xml and construct a new red-rect URL for each of these servlets. So is there anyway I can avoid this or will I have to go through the pain of doing the above mentioned?
Thanks,
Manoj
Sorry the URL-pattern looks this http://FQDN_SERVER.com/servlet-classname?arg1=ABCD&arg2=XYZ