SSC - Web applications and development Introduction and Java Servlet (II)

Transcription

1 SSC - Web applications and development Introduction and Java Servlet (II) Shan He School for Computational Science University of Birmingham Module : SSC

2 Outline Outline of Topics Servlet Configuration Two examples of servlets Java severlet RequestDispatcher interface Java severlet Session Management

3 Servlet Configuration Java Web App Directory Layout A Java web application requires its resources (servlets, JSP s etc.) organised in a standardized way The Root Directory: all files that should be accessible in your web application, including images, html files, etc. The WEB-INF Directory: meta information directory not accessible from a browser web.xml: contains information about the web application, which is used by the Java web server / servlet container in order to properly deploy and execute the web application classes sub-directory: contains all compiled Java classes that are part of your web application. lib sub-directory: contains all JAR files used by your web application.

4 Servlet Configuration Java Web App Directory Layout MyServlet welcome.jsp Index.html META-INF WEB-INF web.xml classes myservlet.class lib Javamail.jar

5 Servlet Configuration Annotation Type WebServlet Java servlet is not accessible if you don t configure your servlet container You need to tell your servlet container: what servlets to deploy, what URL s to map the servlets to This is done by web.xml: web application deployment descriptor

6 Servlet Configuration Configuring and Mapping a Servlet Step 1: configure the servlet to set the servlet name, and to write the class name of the servlet: <servlet> <servlet-name> myservlet </servlet-name> <servlet-class> MyServlet.myservlet </servlet-class> </servlet> Step 2: map the servlet to a URL or URL pattern: <servlet-mapping> <servlet-name>myservlet</servlet-name> <url-pattern>*.html</url-pattern> </servlet-mapping> e.g., all URL s ending in.html are sent to myservlet

7 Servlet Configuration Servlet 3.0 Annotations Enables declarative-style programming: simply annotating the class with appropriate annotations, Make deployment descriptors (web.xml) optional for a web application (but you still need it for welcome page) urlpatterns = { "*.html" }) public class myservlet extends HttpServlet { or public class myservlet extends HttpServlet { Click here to read more about Servlet 3.0 Annotations

8 Two examples of servlets Two examples of servlets To illustrate servlet configuration and the interactions between sevelet and webpages One uses doget and the other uses dopost

9 Java severlet RequestDispatcher interface What is a RequestDispatcher interface RequestDispatcher interface: Defines an object that receives requests from the client and sends them to any resource (such as a servlet, HTML file, or JSP file) on the server. Enables your servlet to call other servlet, HTML file, or JSP file and also pass the request and response Essentially a RequestDispatcher object is created by the servelt container by wrapper around a server resource located at a particular path or given by a particular name. Two methods in the RequestDispatcher interface: forward() : Forwards a request from a servlet to another resource on the server. include() : Includes the content of a resource in the response.

10 Java severlet RequestDispatcher interface Difference between forward() and include() forward() : control is transferred to the next resource you are calling, the next resource will send response to the client browser include() : current servlet retains its control but includes the response sent back by the called resource

11 Java severlet RequestDispatcher interface forward() method forward Request Servlet 1 Servlet 2 Response Generate response Send response to the browser Response

12 Java severlet RequestDispatcher interface include() method include Request Send to the browser Servlet 1 Servlet 2 Response to be included in Servlet 1 Final Response Response

13 Java severlet Session Management What is a session and why use it? Session: a conversation between client and server and it can consists of multiple request and response between them HTTP protocol and Web Servers are stateless: for web server every request is a new request, even it is the same request from the same client Web applications sometimes require the client information to process the request accordingly: Example 1: After login with your correct authentication credential, how does the server remember you have logged in? Example 2: When you add an entry to your cart, how does the server know what you have added earlier? We need to make the server remember what the user entered before.

14 Java severlet Session Management Session ID Session ID: a piece of data that is used in HTTP to identify a session Client store the session ID, while the server associate that ID with other client information such as a user name Steps: Step 1: Client start a session, e.g., requests a page Step 2: Server allocates a random session ID upon the request also store the user information Step 3: Session ID is then communicated back to the client Step 4: If the client sends subsequent requests, it also sends back the same session ID Step 5: The server decide whether the session has expired Step 6: If not expired, the server associates the user information with that session ID and response to the requests

15 Java severlet Session Management How to associate user information with ID Three typical ways of associate user information with ID: Hidden form fields: a unique hidden field in the HTML of which the server can set its value to the session ID and keep track of the session Drawback 1: form with the hidden field must be submitted every time when the request is made from client to server. Drawback 2: Not secure: hacker can get the hidden field value from the HTML source and use it to hack the session. Cookies: a small piece of information that is sent from the server and stored in the client s browser. When client make further request, it adds the cookie to the request header and we can utilize it to keep track of the session URL Rewriting: Appends a session identifier parameter with every request and response to keep track of the session.

16 Java severlet Session Management How to associate user information using cookies? Client Login Post Username=GWBush Password=1+1=3 Set Cookie: SESSIONID=24D644 2B89D1B65FECF1C 8D9FC2232D0 Server Login successful? 1. Create session ID 2. Return session ID in a cookie 3. Store session ID in a database Session ID Username CreatedTime ExpiredTime LassAccessTime Cookie: SESSIONID=24D644 2B89D1B65FECF1C 8D9FC2232D0 Lookup session ID Session still valid? Database Content for GWBush

17 Java severlet Session Management How to use sessions in Servlet? Java Sevlet session management provides functions to: Transmit the session ID from server to client and vice versa; Select stored session IDs; Store associated objects/data with each session and check for session expiry. The Java Sevlet session management can use HttpSession class, which essentially uses cookies, or directly use Cookie class, or URL rewriting HttpSession class provides methods to manage Sessions: getsession(true) : create a new session object getsession() : returns the session object associated with the current request setattribute / getattribute : storing/retrieve information in a session invalidate() : discarding completed or abandoned sessions