95-702 Distributed Systems Lecture 2: Server-Side Programming: An - - PowerPoint PPT Presentation

▶
95 702 distributed systems lecture 2 server side
SMART_READER_LITE
LIVE PREVIEW

95-702 Distributed Systems Lecture 2: Server-Side Programming: An - - PowerPoint PPT Presentation

Mar 28, 2024 199 likes •740 views

95-702 Distributed Systems Lecture 2: Server-Side Programming: An Introduction to Servlets 95-702 Distributed Systems 1 Master of Information System Management What is a Servlet? Created by Sun back in 1997 A Java class that extends

slide-1
SLIDE 1

95-702 Distributed Systems

1

Master of Information System Management

95-702 Distributed Systems

Lecture 2: Server-Side Programming: An Introduction to Servlets

slide-2
SLIDE 2

95-702 Distributed Systems

2

Master of Information System Management

2

Master of Information System Management

What is a Servlet?

  • Created by Sun back in 1997
  • A Java class that extends HttpServlet
  • Responds to HTTP requests
  • The response is usually XHTML or some other

XML language

  • May maintain state across several interactions

(may use cookies or URL rewriting or hidden form fields)

  • Live within a web container
  • May be generated by a JSP compiler
slide-3
SLIDE 3

95-702 Distributed Systems

3

Master of Information System Management

Servlet Lifecycle

  • The container loads the servlet class.
  • The servlet’s init() method is called exactly once.
  • Upon each request, the container calls the servlet’s

service() method.

  • The service() method selects the appropriate method to

call and calls it.

  • Finally, before the container shuts down, it calls the

servlet’s destroy() method.

3

Master of Information System Management

slide-4
SLIDE 4

95-702 Distributed Systems

4

Master of Information System Management

What is an HTTP request?

/* From Core Servlets, Marty Hall An HTTP Request header example GET /path/file.html HTTP/1.0 The whitespace is required. Accept: text/html Accept header fields Accept: audio/x tell the server MIME types User-agent: MacWeb (Multipurpose Internet Mail Extension) that are handled by the browser. HTTP defines dozens of possible headers. A blank line followed by name value pairs or an XML document

slide-5
SLIDE 5

95-702 Distributed Systems

5

Master of Information System Management

What is an HTTP Response?

An HTTP Response header example HTTP 1.0 200 OK Server: NCSA/1.4.2 MIME-version: 1.0 Content-type: text/html Content-length: 107 <html> : : </html> Blank line MIME type The client must interpret this MIME encoded data. Response code

slide-6
SLIDE 6

95-702 Distributed Systems

6

Master of Information System Management

Request Reply Pattern

Request Request Channel Reply channel reply Requestor Replier The pattern applies in the asynchronous and synchronous cases. HTTP is synchronous request reply. From “Enterprise Integration Patterns”.

slide-7
SLIDE 7

95-702 Distributed Systems

7

Master of Information System Management

HTTP General Form <method> <resource identifier> <HTTP Version> <crlf> [<Header> : <value>] <crlf> : : : [<Header> : <value>] <crlf> a blank line [entity body] The resource identifier field specifies the name of the target resource; it's the URL stripped of the protocol and the server domain name. When using the GET method, this field will also contain a series of name=value pairs separated by ‘&’. When using a POST method, the entity body contains these pairs. The HTTP version identifies the protocol used by the client.

slide-8
SLIDE 8

95-702 Distributed Systems

8

Master of Information System Management

Reading Form Data With Servlets Under a Web Server (Glassfish)

// QueryData.java -- Handle the voting form in radio.html import java.io.*; import javax.servlet.*; import javax.servlet.http.*; public class QueryData extends HttpServlet { public void doPost(HttpServletRequest req, HttpServletResponse response) throws ServletException, IOException { doGet(req, response); }

slide-9
SLIDE 9

95-702 Distributed Systems

9

Master of Information System Management

public void doGet(HttpServletRequest req,

HttpServletResponse response) throws ServletException, IOException { String newPresident = req.getParameter("president"); response.setContentType("text/html"); PrintWriter out = response.getWriter(); String docType = "<!DOCTYPE HTML PUBLIC \"//W3C//DTD” + “HTML 4.0 "; docType += "Transitional//EN\">\n";

slide-10
SLIDE 10

95-702 Distributed Systems

10

Master of Information System Management

  • ut.println(docType + "<HTML>\n" +

"<HEAD><TITLE>Presidential Servlet" + "</TITLE>” + “</HEAD>\n" + "<BODY>\n" + "<H1>The new president is "+ newPresident + "</H1>\n" + "</BODY></HTML>"); } }

slide-11
SLIDE 11

95-702 Distributed Systems

11

Master of Information System Management

<!-- index.jsp -->

<html> <head> <title>Radio Buttons</title> </head> <body BGCOLOR="WHITE"> <form action="http://localhost:8080/WeekTwoServlets/QueryData"> <dl> <dt> Please Vote </dt> <dd><Input type = "Radio" name = "president" value= "Bush"> <b>George W. Bush</b> <dd><Input type = "Radio" name = "president" value = "Gore"> Al Gore <dd><Input type = "Radio" name = "president" value = "Buchanan"> Pat Buchanan <dd><Input type = "Radio" name = "president" value = "Nader"> Ralph Nader <p> <input type = "submit"> </dl> </form> </body> </html>

servlet Web server’s port

Project path

slide-12
SLIDE 12

95-702 Distributed Systems

12

Master of Information System Management

Radio HTML in the browser

slide-13
SLIDE 13

95-702 Distributed Systems

13

Master of Information System Management

The Servlet’s Response

slide-14
SLIDE 14

95-702 Distributed Systems

14

Master of Information System Management

NetBeans Project List

Netbeans provides a development environment. The software is deployed to Glassfish.

slide-15
SLIDE 15

95-702 Distributed Systems

15

Master of Information System Management

NetBeans Generated web.xml

Note how the servlet’s name is associated with a URL pattern. “QueryData” is a user defined identifier for use only within this file.

<?xml version="1.0" encoding="UTF-8"?> <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation= "http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"> <servlet> <servlet-name>QueryData</servlet-name> <servlet-class>QueryData</servlet-class> </servlet> <servlet-mapping> <servlet-name>QueryData</servlet-name> <url-pattern>/QueryData</url-pattern> </servlet-mapping> <session-config> <session-timeout> 30 </session-timeout> </session-config> <welcome-file-list> <welcome-file>index.jsp</welcome-file> </welcome-file-list> </web-app>

slide-16
SLIDE 16

95-702 Distributed Systems

16

Master of Information System Management

Some Non-Functional Characteristics

16

Master of Information System Management

Interoperability ? Concurrency? Security? Eve? Mallory? Suppose we were to configure the web server to do SSL. Interoperability ? Concurrency? Security? Eve? Mallory? Does SSL provide secure voting?

slide-17
SLIDE 17

95-702 Distributed Systems

17

Master of Information System Management

Handling CheckBoxes

<!-- CheckBox.html --> <html> <head> <title>CheckBoxes</title> </head> <body BGCOLOR="WHITE"> <form action="http://localhost:8080/servlet/PizzaData"> <dl> <dt> Select Pizza Toppings </dt> <dd><Input type = "CheckBox" name = "Pepperoni"> Pepperoni <dd><Input type = "CheckBox" name = "Sausage"> Sausage <dd><Input type = "CheckBox" name = "Extra Cheese"> Extra Cheese <dd><Input type = "CheckBox" name = "Mushrooms"> Mushrooms <p> <input type = "submit"> </dl> </form> </body> </html>

servlet

slide-18
SLIDE 18

95-702 Distributed Systems

18

Master of Information System Management

Pizza Toppings

slide-19
SLIDE 19

95-702 Distributed Systems

19

Master of Information System Management

Servlet Response

slide-20
SLIDE 20

95-702 Distributed Systems

20

Master of Information System Management

PizzaData Servlet

// PizzaData.java -- Handle the toppings selection from pizza.html import java.io.*; import java.util.*; import javax.servlet.*; import javax.servlet.http.*; public class PizzaData extends HttpServlet { public void doPost(HttpServletRequest req, HttpServletResponse response) throws ServletException, IOException { doGet(req, response); }

slide-21
SLIDE 21

95-702 Distributed Systems

21

Master of Information System Management

public void doGet(HttpServletRequest req, HttpServletResponse response) throws ServletException, IOException { response.setContentType("text/html"); PrintWriter out = response.getWriter(); String finalString = ""; Enumeration paramNames = req.getParameterNames(); while(paramNames.hasMoreElements()) { String paramName = (String) paramNames.nextElement(); finalString += paramName + ":" ; finalString += req.getParameter(paramName) + "<p>"; } Enumerate over the input.

slide-22
SLIDE 22

95-702 Distributed Systems

22

Master of Information System Management

String docType = "<!DOCTYPE HTML PUBLIC \"//W3C//DTD” + “ HTML 4.0 "; docType += "Transitional//EN\">\n";

  • ut.println(docType +

"<HTML>\n" + "<HEAD><TITLE>Pizza Selections" + "</TITLE>” + “</HEAD>\n" + "<BODY>\n" + "<H1>" + finalString + "</H1>\n" + "</BODY></HTML>"); } }

slide-23
SLIDE 23

95-702 Distributed Systems

23

Master of Information System Management

web.xml

<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN" "http://java.sun.com/j2ee/dtds/web-app_2_2.dtd"> <web-app> <servlet> <servlet-name>NameInThisFile</servlet-name> <servlet-class>PizzaData</servlet-class> <load-on-startup/> </servlet> <servlet-mapping> <servlet-name>NameInThisFile</servlet-name> <url-pattern>/PizzaData/*</url-pattern> </servlet-mapping> </web-app>

slide-24
SLIDE 24

95-702 Distributed Systems

24

Master of Information System Management

24

Master of Information System Management

Some Non-Functional Characteristics

24

Master of Information System Management

Interoperability ? Concurrency? Security? Eve? Mallory? Suppose we were to configure the web server to do SSL. Interoperability ? Concurrency? Security? Eve? Mallory? Does SSL provide secure electronic commerce?

slide-25
SLIDE 25

95-702 Distributed Systems

25

Master of Information System Management

Part II Session Tracking and Servlet Collaboration

  • First we will use a shared object.
  • Then we’ll use Java’s Session Tracking API.
slide-26
SLIDE 26

95-702 Distributed Systems

26

Master of Information System Management

Session Tracking with Servlets

HTTP is a normally a stateless protocol. What does that mean? Compare buying coffee at Starbucks with the act of eating a seven course meal at The Tavern On The Green. We can add state to HTTP by having each user introduce themselves in some way. We’ll look at traditional session tracking and then look at the Session Tracking API.

slide-27
SLIDE 27

95-702 Distributed Systems

27

Master of Information System Management

Traditional Session Tracking

  • User Authorization
  • Hidden Form fields
  • URL Rewriting
  • Persistent cookies

We’ll look at the first and last.

slide-28
SLIDE 28

95-702 Distributed Systems

28

Master of Information System Management

User Authorization

  • The web server requests the user name and password.

The information is available to any servlet that needs it.

  • The browser resends the name and password with each

subsequent request.

  • Data about the user and the user’s state can be saved in a shared
  • bject.
slide-29
SLIDE 29

95-702 Distributed Systems

29

Master of Information System Management

Shared Objects

  • A convenient way to store data associated with a user.
  • There are likely to be many servlets running.
  • They can collaborate through a shared object.
  • Only one instance of the shared object should exist.
  • It has to be available (in the classpath) of the servlets

that needs it.

  • It will be used by several threads and therefore should

protect itself against simultaneous access.

  • We’ll look at a shared object and two servlets that use it.
slide-30
SLIDE 30

95-702 Distributed Systems

30

Master of Information System Management

VisitTracker.java

// Servlet collaboration can be done through a shared object. // Any servlet has access to this object and it only has one // instance. // It maintains a hash table of names and dates. // Sections of code that must not be executed simultaneously // are called critical sections. Java provides the synchronized // keyword to protect these critical sections. For a synchronized // instance method, Java obtains an exclusive lock on the class // instance. import java.util.*;

slide-31
SLIDE 31

95-702 Distributed Systems

31

Master of Information System Management

public class VisitTracker { private Map nameDatePairs; private static VisitTracker instance = new VisitTracker(); private VisitTracker() { // private constructor nameDatePairs = new HashMap(); } public static VisitTracker getInstance() { return instance; } synchronized public void addVisit(String userName) { nameDatePairs.put(userName, new Date()); }

slide-32
SLIDE 32

95-702 Distributed Systems

32

Master of Information System Management

synchronized public Date lastVisit(String name) { Date d = (Date)nameDatePairs.get(name); return d; } }

slide-33
SLIDE 33

95-702 Distributed Systems

33

Master of Information System Management

User Authorization

  • Administered by the web server – Glassfish
  • A realm is a set of name, password, role triples
  • Different realms are possible - RDBMS or LDAP
  • Use the GlassFish administrator tool at localhost:4848
  • The GlassFish admin-realm is for the app server.
  • Manage users under the file realm.
  • Security requirements are defined in the application’s web.xml.
  • The role is specified in the web.xml.
  • Those users, who know the password and are

assigned the appropriate role, may use the service.

  • From within the servlet use String name = req.getRemoteUser();

to access the user name.

slide-34
SLIDE 34

95-702 Distributed Systems

34

Master of Information System Management

Administer GlassFish at port 4848 Select security tag on left

slide-35
SLIDE 35

95-702 Distributed Systems

35

Master of Information System Management

From the J2EE Tutorial

slide-36
SLIDE 36

95-702 Distributed Systems

36

Master of Information System Management

GlassFish Web.xml (1)

<?xml version="1.0" encoding="UTF-8"?> <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"> <servlet> <servlet-name>NameInThisFile</servlet-name> <servlet-class>UserAuthorizationDemo</servlet-class> </servlet>

slide-37
SLIDE 37

95-702 Distributed Systems

37

Master of Information System Management

GlassFish Web.xml (2)

<servlet-mapping>

<servlet-name>NameInThisFile</servlet-name> <url-pattern>/UserAuthorizationDemo/*</url-pattern> </servlet-mapping> <welcome-file-list> <welcome-file>index.jsp</welcome-file> </welcome-file-list>

slide-38
SLIDE 38

95-702 Distributed Systems

38

Master of Information System Management

GlassFish Web.xml (3)

<security-constraint>

<web-resource-collection> <web-resource-name>SomeProtection</web-resource-name> <url-pattern>/UserAuthorizationDemo/*</url-pattern> <http-method>GET</http-method> </web-resource-collection> <auth-constraint> <role-name>student</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>file</realm-name> </login-config> <security-role> <role-name>student</role-name> </security-role> </web-app>

slide-39
SLIDE 39

95-702 Distributed Systems

39

Master of Information System Management

Sun-web.xml

<?xml version="1.0" encoding="UTF-8"?> <!-- DOCTYPE NOT SHOWN --> <sun-web-app error-url=""> <context-root>/UserAuthorizationProject</context-root> <security-role-mapping> <role-name>student</role-name> <principal-name>Mike</principal-name> <principal-name>Jethro</principal-name> </security-role-mapping> <class-loader delegate="true"/> <jsp-config> <property name="keepgenerated" value="true"> <description>Keep a copy of the generated servlet class' java code.</description> </property> </jsp-config> </sun-web-app>

slide-40
SLIDE 40

95-702 Distributed Systems

40

Master of Information System Management

index.jsp

<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <title>The UserAuthorzationDemo index.jsp page</title> </head> <!-- GetForm.html --> <body> <form method="get" action="UserAuthorizationDemo"> Only authorized visitors please<p> <input type = "submit"> </form> </body> </html>

slide-41
SLIDE 41

95-702 Distributed Systems

41

Master of Information System Management

// UserAuthorizationDemo.java // This servlet reads from GlassFish and finds the name of the // authorized user. It then adds it to a hash table storing // the time of this visit. It makes use of VisitTracker. import java.io.*; import java.util.*; import javax.servlet.*; import javax.servlet.http.*; public class UserAuthorizationDemo extends HttpServlet { public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {

slide-42
SLIDE 42

95-702 Distributed Systems

42

Master of Information System Management

res.setContentType("text/plain"); PrintWriter out = res.getWriter(); String name = req.getRemoteUser(); // ask the server if(name == null) { System.out.println("The system administrator should protect" + " this page."); } else {

  • ut.println("This user was authorized by the server:" + name);

VisitTracker visit = VisitTracker.getInstance(); Date last = visit.lastVisit(name); if(last == null) out.println("Welcome, you were never here before"); else out.println("Your last visit was on " + last); visit.addVisit(name); } } }

slide-43
SLIDE 43

95-702 Distributed Systems

43

Master of Information System Management

slide-44
SLIDE 44

95-702 Distributed Systems

44

Master of Information System Management

44

Master of Information System Management

Some Non-Functional Characteristics

44

Master of Information System Management

Interoperability ? Concurrency? Security? Eve? Mallory? Suppose we were to configure the web server to do SSL. Interoperability ? Concurrency? Security? Eve? Mallory? If we are using SSL is user authentication still useful?

slide-45
SLIDE 45

95-702 Distributed Systems

45

Master of Information System Management

HTTP Cookies

  • Perhaps we don’t want to authenticate our users but would

still like to interact with them using a stateful application level protocol. Can you give some examples?

  • A cookie is a bit of information (name=value pair) sent by a web server

to a browser. On subsequent visits, the cookie is sent back to the server.

  • The server can use the information as a

key to recover information about prior visits. This information may be in a database or a shared object.

  • Cookies are read from the request object by calling

getCookies() on the request object.

  • Cookies are placed in the browser by calling addCookie()
  • n the response object.
slide-46
SLIDE 46

95-702 Distributed Systems

46

Master of Information System Management

Using Cookies

// CookieDemo.java // This servlet uses a cookie to determine when the // last visit by this browser occurred. It makes use of // the VisitTracker object. // Cookies normally expire as soon as the browser exits. // We want the cookie to last one year and so we use // setMaxAge(seconds) on the cookie. import java.io.*; import java.util.*; import javax.servlet.*; import javax.servlet.http.*;

slide-47
SLIDE 47

95-702 Distributed Systems

47

Master of Information System Management

public class CookieDemo extends HttpServlet { public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException { res.setContentType("text/plain"); PrintWriter out = res.getWriter(); Cookie[] c = req.getCookies(); // If this person has been here before then we should have // a cookiedemouser field assigned to a unique id. String id = null;

slide-48
SLIDE 48

95-702 Distributed Systems

48

Master of Information System Management

if (c!=null) { // we may have the cookie we are after for (int i=0;i<c.length;i++) { if (c[i].getName().equals("cookiedemouser")) { id = c[i].getValue(); break; } } }

slide-49
SLIDE 49

95-702 Distributed Systems

49

Master of Information System Management

if (id == null) { // They have not been here before and need a // cookie. We get a unique string (with respect // to this host)and make sure it is of the 'query string' form. // It uses the clock. Don’t turn the clock back! String uid = new java.rmi.server.UID().toString(); id = java.net.URLEncoder.encode(uid); Cookie oreo = new Cookie("cookiedemouser",id);

  • reo.setMaxAge(60*60*24*365);

res.addCookie(oreo); } VisitTracker visit = VisitTracker.getInstance(); Date last = visit.lastVisit(id); if(last == null) out.println("Welcome, you were never here before"); else out.println("Your last visit was on " + last); visit.addVisit(id); } }

slide-50
SLIDE 50

95-702 Distributed Systems

50

Master of Information System Management

The New Session Tracking API

  • Support may vary depending on the server.
  • Implemented with cookies or with URL rewriting if cookies

fail (URL rewriting requires help from the servlet).

  • Every user of the site is associated with a

javax.servlet.http.HttpSession object

  • The session object can hold any arbitrary set of Java objects.
  • Servlets collaborate by accessing the session object.
  • The following example abstracts away shared object concerns.
  • All valid sessions are grouped together in a HttpSessionContext
  • bject
slide-51
SLIDE 51

95-702 Distributed Systems

51

Master of Information System Management

The Session Tracking API

// SessionDemo.java // The session object associated with this user/browser is available // to other servlets. import java.io.*; import javax.servlet.*; import javax.servlet.http.*; import java.util.*; public class SessionDemo extends HttpServlet {

slide-52
SLIDE 52

95-702 Distributed Systems

52

Master of Information System Management

public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException { res.setContentType("text/plain"); PrintWriter out = res.getWriter(); // Get the current session object. Create one if none exists. HttpSession session = req.getSession(true); // Get the Date associated with this session Date d = (Date)session.getAttribute("dateofvisit"); if(d == null) out.println("Your first time, welcome!"); else out.println("Your last visit was on " + d); session.setAttribute("dateofvisit", new Date()); } }

slide-53
SLIDE 53

95-702 Distributed Systems

53

Master of Information System Management

53

Master of Information System Management

Some Non-Functional Characteristics

53

Master of Information System Management

Interoperability ? Concurrency? Security? Eve? Mallory? Suppose we were to configure the web server to do SSL. Interoperability ? Concurrency? Security? Eve? Mallory?