WEB TECHNOLOGIES
A COMPUTER SCIENCE PERSPECTIVE
JEFFREY C. JACKSON
Chapter 6
Server-side Programming:
Java Servlets
Jackson, Web Technologies: A Computer Science Perspective, © 2007 Prentice-Hall, Inc. All rights reserved. 0-13-185603-0
Server-side Programming
• The combination of
– HTML
– JavaScript
– DOM
is sometimes referred to as Dynamic HTML
(DHTML)
• Web pages that include scripting are often
called dynamic pages (vs. static)
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Server-side Programming
• Similarly, web server response can be
static or dynamic
– Static: HTML document is retrieved from the
file system and returned to the client
– Dynamic: HTML document is generated by a
program in response to an HTTP request
• Java servlets are one technology for
producing dynamic server responses
– Servlet is a Java class instantiated by the
server to produce a dynamic response
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Servlet Overview
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Servlet Overview
1. When server starts, it instantiates servlets
2. Server receives HTTP request, determines
need for dynamic response
3. Server selects the appropriate servlet to
generate the response, creates
request/response objects, and passes them to
a method on the servlet instance
4. Servlet adds information to response object via
method calls
5. Server generates HTTP response based on
information stored in response object
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Hello World! Servlet
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Hello World! Servlet
All servlets we will write
are subclasses of
HttpServlet
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Hello World! Servlet
Server calls doGet() in response to GET request
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Hello World! Servlet
Interfaces implemented by request/response objects
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Hello World! Servlet
Production servlet should
catch these exceptions
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Servlets vs. Java Applications
• Servlets do not have a main()
– The main() is in the server
– Entry point to servlet code is via call to a
method (doGet() in the example)
• Servlet interaction with end user is indirect
via request/response object APIs
– Actual HTTP request/response processing is
handled by the server
• Primary servlet output is typically HTML
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Running Servlets
• Simple way to run a servlet (better later):
1. Compile servlet (make sure that JWSDP
libraries are on path)
2. Copy .class file to shared/classes
directory
3. (Re)start the Tomcat web server
4. If the class is named ServletHello,
browse to
http://localhost:8080/servlet/ServletHello
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Dynamic Content
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Dynamic Content
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Dynamic Content
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Servlet Life Cycle
• Servlet API life cycle methods
– init(): called when servlet is instantiated;
must return before any other methods will be
called
– service(): method called directly by server
when an HTTP request is received; default
service() method calls doGet() (or
related methods covered later)
– destroy(): called when server shuts down
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Parameter Data
• GET vs. POST for the method attribute of forms:
– GET:
– Choosing GET as the "method" will append all of the data to the URL
and it will show up in the URL bar of your browser.
– The amount of information you can send back using a GET is restricted
as URLs can only be 1024 characters.
– Recommended when parameter data is not stored or updated on the
server, but used only to request information (e.g., search engine query)
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Parameter Data
• GET vs. POST method for forms:
– POST:
• Query string is sent as body of HTTP request
• Length of query string is unlimited
• Recommended if parameter data is intended to
cause the server to update stored data
• Most browsers will warn you if they are about to
resubmit POST data to avoid duplicate updates
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
• Many interactive Web sites spread user data entry out over several
pages:
– Ex: add items to cart, enter shipping information, enter billing
information
• Problem: how does the server know which users generated which
HTTP requests?
– Cannot rely on standard HTTP headers to identify a user
• A session can be defined as a server-side storage of information
that is desired to persist throughout the user's interaction with the
web site or web application.
•
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
Server sends back
new unique
session ID when
the request has
none
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
Client that supports
session stores the
ID and sends it
back to the server
in subsequent
requests
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
Server knows
that all of these
requests are
from the same
client. The
set of requests
is known as a
session.
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
And the server
knows that all
of these
requests are
from a different
client.
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
Three web
pages produced
by a single servlet
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Sessions
• How to get the HttpSession object ?
• The HttpServletRequest interface provides two methods to get the object of
HttpSession:
• public HttpSession getSession():Returns the current session associated
with this request, or if the request does not have a session, creates one.
• public HttpSession getSession(boolean create):Returns the current
HttpSession associated with this request or, if there is no current session
and create is true, returns a new session.
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Commonly used methods of HttpSession interface
• public String getId():Returns a string containing the unique identifier
value.
• public long getCreationTime():Returns the time when this session was
created, measured in milliseconds since midnight January 1, 1970 GMT.
• public long getLastAccessedTime():Returns the last time the client
sent a request associated with this session, as the number of milliseconds
since midnight January 1, 1970 GMT.
• public void invalidate():Invalidates this session then unbinds any
objects bound to it.
• setMaxInactiveInterval(int )Returns the maximum time
interval, in seconds, that the servlet container will keep this session open
between client accesses.
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Cookies
• A cookie is a name/value pair in the Set-Cookie header field of an HTTP response.
• A HTTP cookie (also called web cookie, Internet cookie, browser cookie or
simply cookie), is a small piece of data sent from a website and stored in a
user's web browser while the user is browsing that website.
• Every time the user loads the website, the browser sends the cookie back to the
server to notify the website of the user's previous activity.
• Cookies were designed to be a reliable mechanism for websites to
remember stateful information (such as items in a shopping cart) or to record the
user's browsing activity (including clicking particular buttons, logging in, or recording
which pages were visited by the user as far back as months or years ago)
• .
• Without cookies, websites and their servers have no memory. A cookie, like a key,
enables swift passage from one place to the next.
• Without a cookie every time you open a new web page the server where that page is
stored will treat you like a completely new visitor.
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Cookies
Tomcat sends
session ID as value
of cookie named
JSESSIONID
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Cookies
Cookie-enabled
browser returns
session ID as value
of cookie named
JSESSIONID
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Cookies
• Servlets can set cookies explicitly
– Cookie class used to represent cookies
– request.getCookies() returns an array of
Cookie instances representing cookie data in
HTTP request
– response.addCookie(Cookie) adds a
cookie to the HTTP response
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Cookies
Cookies are expired by
client (server can request
expiration date)
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Cookies
Privacy issues
HTTP request to
intended site Web site
providing
requested
HTTP response:
content
HTML document
Client
including ad <img>
HTTP request for
ad image
Image
plus Set-Cookie Web site
in response: providing
third-party cookie banner
ads
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Cookies
Privacy issues
Second
HTTP request to 2nd Web site
intended site providing
Web site requested
providing content
requested
HTTP response:
content
HTML document
Client
including ad <img>
HTTP request for
ad image plus Cookie (identifies user)
Image Based on
Web site
providing Referer, I know two
banner Web sites that
ads this user has
visited
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Cookies
Privacy issues
• Due to privacy concerns, many users
block cookies
– Blocking may be fine-tuned. Ex: Mozilla
allows
• Blocking of third-party cookies
• Blocking based on on-line privacy policy
• Alternative to cookies for maintaining
session: URL rewriting
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Data Storage
• Almost all web applications (servlets or related
dynamic web server software) store and retrieve
data
– Typical web app uses a data base management
system (DBMS)
– Another option is to use the file system
– Not web technologies, so beyond our scope
• Some Java data storage details provided in
Appendices B (file system) and C (DBMS)
• One common problem: concurrency
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
Common Gateway Interface
• The common gateway interface (CGI) is a standard way for a Web server to pass a Web user's
request to an application program and to receive data back to forward to the user.
• When the user requests a Web page (for example, by clicking on a highlighted word or entering
a Web site address), the server sends back the requested page. However, when a user fills out a
form on a Web page and sends it in, it usually needs to be processed by an application program.
• The Web server typically passes the form information to a small application program that
processes the data and may send back a confirmation message. This method or convention for
passing data back and forth between the server and the application is called the common
gateway interface (CGI). It is part of the Web's Hypertext Transfer Protocol (HTTP).
Dr. Thomas Tran – CSI3140 Lecture Notes (based on Dr. Jeffrey Jackson’s slides)
