Upload
stella-cora-warren
View
216
Download
1
Tags:
Embed Size (px)
Citation preview
Generating Dynamic Content for the Web
University of Georgia
CSCI 48006800
Technologies for generating dynamic content
CGIServletsJSPStrutsJSF
Web Content Types
Three types of content Static Dynamic Active
Static Content
1048708 defined in text file by page author1048708 remains unchanged until edited
Dynamic content
1048708 generated on demand by HTTP server1048708 program on server returns output to
client1048708 counters database searching search
engines questionnaires up-to-date info
Active content
executes code on the client computeruser interaction display updating remote
connections smart forms
Dynamic Content
Server must be able to execute program The program generates the document dynamically
1048708 Server programs can be written in any language Shell scripts C C++ Java Perl Tcl PHP Python ASP etc
1048708 Program output returned to web client via HTTP server 1048708 Output must be in form of static page
eg Content-type texthtml imagegif etc Some types of content can contain dynamic components
1048708 Server needs to recognize dynamic document request On a per-directory basis eg cgi-bin Or via file names eg jsp
Common Gateway Interface(CGI) 1048708 CGI standard defines server-program interaction
Developed at the National Center for Supercomputing Applications (NCSA)
1048708 CGI was the first way of generating dynamic content 1048708 Based on the Unix shell model
Parameters passed via stdinstdout and shell environment variables
1048708 Typically a special directory is used on the server for CGI programs 1048708 cgi-bin
1048708 URL selects program to run httphostcgi-binprogram
CGI
WWW Client
CGIprogram
WWWServer
request
response
Invoke CGI
CGI output
internet server
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Technologies for generating dynamic content
CGIServletsJSPStrutsJSF
Web Content Types
Three types of content Static Dynamic Active
Static Content
1048708 defined in text file by page author1048708 remains unchanged until edited
Dynamic content
1048708 generated on demand by HTTP server1048708 program on server returns output to
client1048708 counters database searching search
engines questionnaires up-to-date info
Active content
executes code on the client computeruser interaction display updating remote
connections smart forms
Dynamic Content
Server must be able to execute program The program generates the document dynamically
1048708 Server programs can be written in any language Shell scripts C C++ Java Perl Tcl PHP Python ASP etc
1048708 Program output returned to web client via HTTP server 1048708 Output must be in form of static page
eg Content-type texthtml imagegif etc Some types of content can contain dynamic components
1048708 Server needs to recognize dynamic document request On a per-directory basis eg cgi-bin Or via file names eg jsp
Common Gateway Interface(CGI) 1048708 CGI standard defines server-program interaction
Developed at the National Center for Supercomputing Applications (NCSA)
1048708 CGI was the first way of generating dynamic content 1048708 Based on the Unix shell model
Parameters passed via stdinstdout and shell environment variables
1048708 Typically a special directory is used on the server for CGI programs 1048708 cgi-bin
1048708 URL selects program to run httphostcgi-binprogram
CGI
WWW Client
CGIprogram
WWWServer
request
response
Invoke CGI
CGI output
internet server
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Web Content Types
Three types of content Static Dynamic Active
Static Content
1048708 defined in text file by page author1048708 remains unchanged until edited
Dynamic content
1048708 generated on demand by HTTP server1048708 program on server returns output to
client1048708 counters database searching search
engines questionnaires up-to-date info
Active content
executes code on the client computeruser interaction display updating remote
connections smart forms
Dynamic Content
Server must be able to execute program The program generates the document dynamically
1048708 Server programs can be written in any language Shell scripts C C++ Java Perl Tcl PHP Python ASP etc
1048708 Program output returned to web client via HTTP server 1048708 Output must be in form of static page
eg Content-type texthtml imagegif etc Some types of content can contain dynamic components
1048708 Server needs to recognize dynamic document request On a per-directory basis eg cgi-bin Or via file names eg jsp
Common Gateway Interface(CGI) 1048708 CGI standard defines server-program interaction
Developed at the National Center for Supercomputing Applications (NCSA)
1048708 CGI was the first way of generating dynamic content 1048708 Based on the Unix shell model
Parameters passed via stdinstdout and shell environment variables
1048708 Typically a special directory is used on the server for CGI programs 1048708 cgi-bin
1048708 URL selects program to run httphostcgi-binprogram
CGI
WWW Client
CGIprogram
WWWServer
request
response
Invoke CGI
CGI output
internet server
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Static Content
1048708 defined in text file by page author1048708 remains unchanged until edited
Dynamic content
1048708 generated on demand by HTTP server1048708 program on server returns output to
client1048708 counters database searching search
engines questionnaires up-to-date info
Active content
executes code on the client computeruser interaction display updating remote
connections smart forms
Dynamic Content
Server must be able to execute program The program generates the document dynamically
1048708 Server programs can be written in any language Shell scripts C C++ Java Perl Tcl PHP Python ASP etc
1048708 Program output returned to web client via HTTP server 1048708 Output must be in form of static page
eg Content-type texthtml imagegif etc Some types of content can contain dynamic components
1048708 Server needs to recognize dynamic document request On a per-directory basis eg cgi-bin Or via file names eg jsp
Common Gateway Interface(CGI) 1048708 CGI standard defines server-program interaction
Developed at the National Center for Supercomputing Applications (NCSA)
1048708 CGI was the first way of generating dynamic content 1048708 Based on the Unix shell model
Parameters passed via stdinstdout and shell environment variables
1048708 Typically a special directory is used on the server for CGI programs 1048708 cgi-bin
1048708 URL selects program to run httphostcgi-binprogram
CGI
WWW Client
CGIprogram
WWWServer
request
response
Invoke CGI
CGI output
internet server
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Dynamic content
1048708 generated on demand by HTTP server1048708 program on server returns output to
client1048708 counters database searching search
engines questionnaires up-to-date info
Active content
executes code on the client computeruser interaction display updating remote
connections smart forms
Dynamic Content
Server must be able to execute program The program generates the document dynamically
1048708 Server programs can be written in any language Shell scripts C C++ Java Perl Tcl PHP Python ASP etc
1048708 Program output returned to web client via HTTP server 1048708 Output must be in form of static page
eg Content-type texthtml imagegif etc Some types of content can contain dynamic components
1048708 Server needs to recognize dynamic document request On a per-directory basis eg cgi-bin Or via file names eg jsp
Common Gateway Interface(CGI) 1048708 CGI standard defines server-program interaction
Developed at the National Center for Supercomputing Applications (NCSA)
1048708 CGI was the first way of generating dynamic content 1048708 Based on the Unix shell model
Parameters passed via stdinstdout and shell environment variables
1048708 Typically a special directory is used on the server for CGI programs 1048708 cgi-bin
1048708 URL selects program to run httphostcgi-binprogram
CGI
WWW Client
CGIprogram
WWWServer
request
response
Invoke CGI
CGI output
internet server
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Active content
executes code on the client computeruser interaction display updating remote
connections smart forms
Dynamic Content
Server must be able to execute program The program generates the document dynamically
1048708 Server programs can be written in any language Shell scripts C C++ Java Perl Tcl PHP Python ASP etc
1048708 Program output returned to web client via HTTP server 1048708 Output must be in form of static page
eg Content-type texthtml imagegif etc Some types of content can contain dynamic components
1048708 Server needs to recognize dynamic document request On a per-directory basis eg cgi-bin Or via file names eg jsp
Common Gateway Interface(CGI) 1048708 CGI standard defines server-program interaction
Developed at the National Center for Supercomputing Applications (NCSA)
1048708 CGI was the first way of generating dynamic content 1048708 Based on the Unix shell model
Parameters passed via stdinstdout and shell environment variables
1048708 Typically a special directory is used on the server for CGI programs 1048708 cgi-bin
1048708 URL selects program to run httphostcgi-binprogram
CGI
WWW Client
CGIprogram
WWWServer
request
response
Invoke CGI
CGI output
internet server
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Dynamic Content
Server must be able to execute program The program generates the document dynamically
1048708 Server programs can be written in any language Shell scripts C C++ Java Perl Tcl PHP Python ASP etc
1048708 Program output returned to web client via HTTP server 1048708 Output must be in form of static page
eg Content-type texthtml imagegif etc Some types of content can contain dynamic components
1048708 Server needs to recognize dynamic document request On a per-directory basis eg cgi-bin Or via file names eg jsp
Common Gateway Interface(CGI) 1048708 CGI standard defines server-program interaction
Developed at the National Center for Supercomputing Applications (NCSA)
1048708 CGI was the first way of generating dynamic content 1048708 Based on the Unix shell model
Parameters passed via stdinstdout and shell environment variables
1048708 Typically a special directory is used on the server for CGI programs 1048708 cgi-bin
1048708 URL selects program to run httphostcgi-binprogram
CGI
WWW Client
CGIprogram
WWWServer
request
response
Invoke CGI
CGI output
internet server
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Common Gateway Interface(CGI) 1048708 CGI standard defines server-program interaction
Developed at the National Center for Supercomputing Applications (NCSA)
1048708 CGI was the first way of generating dynamic content 1048708 Based on the Unix shell model
Parameters passed via stdinstdout and shell environment variables
1048708 Typically a special directory is used on the server for CGI programs 1048708 cgi-bin
1048708 URL selects program to run httphostcgi-binprogram
CGI
WWW Client
CGIprogram
WWWServer
request
response
Invoke CGI
CGI output
internet server
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
CGI
WWW Client
CGIprogram
WWWServer
request
response
Invoke CGI
CGI output
internet server
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
CGI Pros and Cons
Pros of CGI 1048708 Simple suitable for small once-off tasks 1048708 Supported by all web servers
1048708 Cons of CGI 1048708 Slow web server forks new process for every
request 1048708 Parameter decoding tedious
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTML Forms
Dynamic content is often generated in response to HTML forms
Example httpwwwrandomorgnformhtml
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTML Forms
ltform method=ldquogetrdquoaction=ldquohttpwwwrandomorgcgi-binrandbyterdquogt
ltpgtGenerate ltinput type=text name=nbytesgt random bytes (maximum16384)ltpgtltpgtFormatltpgtltinput type=radio name=format value=hex checkedgt Hexadecimalltbrgtltinput type=radio name=format value=decgt Decimal ltbrgtltinput type=radio name=format value=octgt Octal ltbrgtltinput type=radio name=format value=bingt Binary ltbrgtltinput type=radio name=format value=filegt Download to a fileltbrgtltinput type=submit value=Get Bytesgtltinput type=reset value=Reset Formgtltformgt
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTML Forms and Parameters
Each form field has a nameFields passed as (name value) pairs
Names and values separated by lsquo=rsquo Multiple pairs separated by lsquoamprsquo eg nbytes=256ampformat=hex Called the query string Non-printable characters are encoded
Space encoded as lsquo+rsquo or lsquo20rsquo Any character can be encoded as x where x is the
characterrsquos ASCII value in hex eg 26 for lsquoamprsquo
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTML Forms and Parameters
With GET requests the query string is appended to the base URL as follows 1048708 pathquerystring
GET cgi-binrandbytenbytes=256ampformat=hex HTTP10
1048708 Query string appears in browsers URL bar 1048708 Query string can be bookmarked 1048708 Query string can be contained in web pages
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTML Forms and Parameters
With POST requests the query string is sent in the optional data field of the HTTP request Unlimited query length Query string not part of URL Hyper-references w POST request containing
query strings cannot be bookmarked or used as hyperlinks
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Comparison hellip
In both cases server side program must decode the data supplied by the client
CGI just gives you the raw query stringDecoding can be tediousOther approaches to dynamic content
generation do this for you Example Java Servlets
HttpServletRequestgetParameter(name)
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
More about query strings
Query strings can be constructed as a fixed URL eg embedded in a page or bookmarked by the browser from a HTML form
Query strings constructed from forms follow the name-value pair format
Otherwise the format is defined by the programmer eg httpwwweboardcomshowjsp234873
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Parameter passing with CGI
When invoked with GET the query string is passed as a shell environment variable called QUERY_STRING 1048708 CGI program must evaluate the variable and parse
the string
When invoked with POST the query string is passed through standard input CGI program must read from stdin and parse the string
In both cases the CGI program outputs the response to stdout
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Simple CGI script example
binsh
echo ldquoContent-type texthtmlnnrdquo
echo ldquolthtmlgtltbodygtltpgtrdquo
echo ldquoYour query string was $QUERY_STRINGrdquo
echo ldquoltpgtltbodygtlthtmlgtrdquo
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTTP and State
1048708 Recall that HTTP is stateless Server maintains no state about clients between
successive HTTP requests Statelessness is an attractive feature because it makes
servers less vulnerable to client failures (and vice versa)
1048708 However state is useful Maintain a history of previous invocations or visits Correlate information from several requests Trace users through a web site
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTTP and State
State can take any form In HTTP typically one or more (name value)
pairs Short-term state can be encoded in a variety of
ways 1048708 in URL to browser (URL rewriting) 1048708 in HTML documents served (hidden fields) 1048708 in cookies
Long-term state can be encoded 1048708 Keep record of hosts addresses in file 1048708 Stored in cookies
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTTP State URL Rewriting
1048708 Server stores state in URLs embedded in content 1048708 State encoded as GET-style HTTP parameters 1048708 Subsequent requests for those URLs will include the
parameters 1048708 eg httpwwwrandomorgessayphpid=212
1048708 Server generates content dynamically 1048708 All local links in the content (page) are translated by
the web server to include the specified state 1048708 eg parameter (name value) pair lsquoid=212rsquo
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
URL Rewriting Example
1048708 The request to wwwrandomorgGET essayphpid=212 HTTP10
1048708 Could result in the following pagelthtmlgtltheadgtltheadgtltbodygtltpgtThere is the lta href=usersphpid=212gtuserspageltagt there is the lta href=clientsid=212gtclientarchiveltagt and we here at lta href=id=212gtrandomorgare grateful to lta href=httpwwwtcdiegtTrinityCollegeltagtltpgtltbodygt
1048708 Note Only local links are rewritten
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
URL Rewriting Example
1048708 With URL rewriting you need a way of creating the first URL Typically done via a login procedure using an HTML
form
1048708 If the server receives a request without parameters it returns a login form instead of the content
1048708 If the login form is submitted (and details validate) the server returns the first page with rewritten URLs
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
URL Rewriting
1048708 With URL rewriting the hyperlinks are personalised
1048708 Support for URL rewriting in some technologies for dynamic content generation
1048708 eg Java ServletsHttpServletResponseencodeURL()
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
URL Rewriting Advantages
URL rewriting works just about everywhere especially when cookies are turned off
Multiple simultaneous sessions are possible for a single user Session information is local to each browser instance
since it is stored in URLs in each page being displayed
1048708 Entirely static pages cannot be used with URL rewriting since every link must be dynamically written with the session state
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
URL Rewriting Disadvantages
1048708 Every URL on a page which needs the session information must be rewritten each time a page is served 1048708 Computationally expensive 1048708 Can increase communication overhead
1048708 State stored in URLs is not persistent 1048708 Can make sharing of URLs difficult 1048708 URL rewriting limits the clients interaction with
the server to HTTP GET requests 1048708 Unless used in combination with hidden fields
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTTP State Hidden Fields
If the content contains forms (eg a multi-form questionnaire) state can be saved in the form(s) 1048708 Special lsquohiddenrsquo form fields not displayed by
the browser Parameters encoded by the browser in the
same way as for ordinary fields
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Hidden Fields Example
First formltform method=post action=form-handlerphpgtltpgtEnter your nameltinput type=text name=user gtltpgt ltinput type=hidden name=stage value=1 gtltinput type=submit value=Next gtltformgt
1048708 Server encodes the state (including values submitted by the user) in the second form
ltform method=post action=form-handlerphpgtltpgtEnter your ageltinput type=text name=age gtltpgt ltinput type=hidden name=stage value=2 gt ltinput
type=hidden name=user value=Joe Random gtltinput type=submit value=Next gtltformgt
1048708 When at the last stage all data is processed
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Hidden Fields Pros and Cons
Pros 1048708 State processing on the server side easier
than URL rewriting hidden fields simply treated as ordinary fields
1048708 Supported by all browsers regardless of userrsquos (cookie) preferences
1048708 Cons 1048708 Requires forms not suitable for plain links 1048708 Others
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTTP State Cookies
1048708 Cookies are 1048708 Small pieces of information 1048708 Sent by web servers to web clients 1048708 Stored by the clients 1048708 Read back by the server who sent the cookie
1048708 Cookies are used to maintain state on the client side
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTTP State Cookies
1048708 Cookies are often used to store 1048708 User IDs and passwords 1048708 Info about preferences or start pages 1048708 Contents of shopping baskets
1048708 But also for 1048708 User tracking within a web site 1048708 Building user profiles 1048708 Targeted marketing (advertising)
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTTP State Cookies
Cookies are set (by the server) via HTTP Response headers
Set-Cookie NAME=VALUE expires=DATEpath=PATH domain=DOMAIN_NAME secure
And sent back (by the client) via HTTP Request headers
Cookie NAME=VALUE NAME=VALUE
Date format DAY DD-MMM-YYYY HHMMSS Path format separated Domain format hostnamesubdomaintld
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTTP State Cookies
1048708 A client will send along a cookie with an HTTP request provided that The server host name from the URL matches the
domain for the cookie The path name from the URL matches the path for the
cookie The cookie has not expired
Limitation Cookies are bound to the server that originally set them Limits cookies within that server domain
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Cookies Example
First requestPOST basket-addphp HTTP10uid=12amppid=9828
Could mean ldquouser 12 adds product 9828 to her shopping basketrdquo
Server responseHTTP10 200 OKSet-Cookie basket=uid=12amppid=9828amppid=7884expires=Tuesday 23-11-2005 144212path=books domain=wwwammozoncom securelthtmlgtltbodygtltpgtThe content of your shopping basketisltpgtltbodygtlthtmlgt
7884 was in the basket already
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Cookies Example
Second requestGET booksspecial-offersphp HTTP10Cookie uid=12amppid=9828amppid=7884
1048708 Third requestGET HTTP10
1048708 Fourth requestGET gnus HTTP10
No cookies are sent because the paths lsquorsquo and lsquognusrsquo do not match lsquobooksrsquo
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Cookies Pros and Cons
1048708 Pros 1048708 Highly transparent to user 1048708 Avoids server getting clogged with state 1048708 Great for personalizing content
1048708 Cons 1048708 Specific to the computer not the user 1048708 Privacy issues
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
HTTP State Cookies
1048708 Seemingly innocent 1048708 Originally designed by Netscape as a simple way of
letting users identify themselves 1048708 Has many uses
1048708 Also less friendly to users 1048708 Privacy Issues
1048708 Can track every single movement of a user through a web site
1048708 Can be used to analyze (and improve) web sites 1048708 But also to build profiles of users 1048708 Try surfing with cookie warnings enabled
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Dynamic Content
1048708 HTML in Code 1048708 CGI scripts (any language) 1048708 Java Servlets 1048708 AOLServerrsquos TCL support
1048708 Code in HTML 1048708 Java Server Pages (JSP) 1048708 Microsoft Active Server Pages (ASP) 1048708 PHP Hypertext Preprocessor (PHP) 1048708 AOLServer Dynamic Pages (ADP) 1048708 mod_perl
1048708 Others
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Java Servlets
1048708 Java on the server side 1048708 Requestresponse based API
1048708 More efficient than CGI 1048708 Loaded once stays resident 1048708 Multiple requests = multiple threads
1048708 Java Servlet Development Kit (JSDK)1048708 Java Servlet API Specification v23
1048708 August 2001 Final Version 1048708 Implemented by Tomcat 51 Jigsaw amp others
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Basic Servlet Interaction
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Basic Servlet Interaction
Web client
Servlet
Web Server
HTTP request
HTTP response
Servlet API
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Java Servlets
Servlets can be used to extend web servers in a modular fashion
1048708 Extra functionality are kept outside the web server core 1048708 Increased web server reliability 1048708 Increased modularity
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Java Servlets
Servlets can use the entire Java language 1048708 In particular the Java Database Connectivity
(JDBC) APIStandard API means
1048708 Servlets once written can be used with any web server implementing the Java Servlet API
1048708 Apache iPlanet Microsoft IIS etc 1048708 This is an advantage over some other server-
side languages (eg ASP) which are (often) bound to a particular server
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Servlet Basics
Servlets work with three types of objects 1048708 Requests 1048708 Responses 1048708 Sessions
1048708 Request objects 1048708 Methods to parse out namevalue parameters 1048708 HTTP request header fields available
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Servlet Basics
1048708 Response objects 1048708 Can set HTTP response status codes and
content
1048708 HTTP session objects 1048708 Methods to identify requests from same client 1048708 Implemented with cookies 1048708 Unique identifier allocated for each session
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Servlet API and Lifecycle
A servlet is an instance of a class implementing the javaxservletServlet interface
1048708 Most servlets extend one of the two classes 1048708 javaxservletGenericServlet 1048708 javaxservlethttpHttpServlet
1048708 The servlet API include these methods 1048708 init() is called when the servlet is loaded 1048708 service() processes requests (concurrently) 1048708 destroy() is called when the servlet is unloaded
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Example Servlet Lifecycle
init
service
service
serviceservice
serviceservice
service
service
Thread 1 Thread 2 Thread 3
destroy
Time
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Servlet API
The service() method dispatches service requests to one of four methods 1048708 doGet doPut doPost doDelete
1048708 These methods are passed two parameters 1048708 One of type HttpServletRequest 1048708 One of type HttpServletResponse
1048708 The parameters are objects that can be invoked to 1048708 Read info about the HTTP request 1048708 Generate the HTTP response
1048708 Sessions are maintained via HttpSession objects 1048708 Accessed via the HttpServletRequest object
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Servlet Example 1import javaioimport javaxservletimport javaxservlethttppublic class Hello extends HttpServletpublic void doGet (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Snoop ServletString ua = requestgetHeader(User-Agent)String ref = requestgetHeader(Referer)responsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHelloltpgt)outprintln(ltpgtYour browser is + ua + and + you got here via + ref + ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Servlet Example 2
Consider the following form used on a site accepting payment via credit cards
ltform method=ldquopostrdquo action=ldquoservletspayrdquogtltinput type=ldquotextrdquo name=ldquonamerdquo gtltinput type=ldquotextrdquo name=ldquoamountrdquo gtltinput type=ldquotextrdquo name=ldquocardnumberrdquo gtltinput type=ldquotextrdquo name=ldquoexpirydaterdquo gtltinput type=ldquosubmitrdquo value=ldquoPayrdquo gtltformgt
1048708 Would we want to use this with a GET request Why or why not
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Servlet Example 2 imports omittedpublic class Hello extends HttpServletpublic void doPost (HttpServletRequest requestHttpServletResponse response)throws ServletException IOExceptionPrintWriter outString title = Payment ServletString n = requestgetParameter(name)String a = requestgetParameter(amount)String cc = requestgetParameter(cardnumber)String ed = requestgetParameter(expirydate) TODO credit card transaction hereresponsesetContentType(texthtml)out = responsegetWriter()outprintln(lthtmlgtltheadgtlttitlegt)outprintln(title)outprintln(lttitlegtltheadgtltbodygt)outprintln(lth1gt + title + lth1gt)outprintln(ltpgtHello + n + ltpgt)outprintln(ltpgtYour card + cc + has been charged euro + a ltpgt)outprintln(ltbodygtlthtmlgt)outclose()
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Servlet API
1048708 ServletRequestHttpServletRequest 1048708 getInputStream 1048708 getProtocol 1048708 getRemoteAddr 1048708 getHeader 1048708 getMethod 1048708 getQueryString 1048708 getRemoteUser 1048708 getSession 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc
Servlet API
1048708 ServletResponseHttpServletResponse 1048708 getOutputStream 1048708 setContentType 1048708 getWriter 1048708 sendRedirect 1048708 etc