book

Beginning JavaServer Pages™

Name: Beginning JavaServer Pages™
ISBN: 9780764574856

by Vivek Chopra, Sing Li, Rupert Jones, John T. Bell, Jon Eaves

February 2005

Intermediate to advanced

1296 pages

29h 21m

English

Wrox

Read now

Unlock full access

Copyright
About the Authors
Credits
Acknowledgments
Introduction
The Right Way to Do Web DevelopmentApproachHow This Book Is StructuredConventionsHow It WorksSource CodeErratap2p.wrox.com
I. JSP Fundamentals
1. Getting Started with JavaServer Pages
1.1. Creating Applications for the Internet1.1.1. Limitations of the basic Web server model1.1.2. Dynamic HTML generation via CGI1.1.3. Shortcomings of CGI1.1.4. Improving Java-based CGI: servlets1.1.4.1. Web server configurations: integrating servlet containers1.1.4.2. Optimizing servlet development: JavaServer Pages1.1.4.2.1. Checking your system for Java1.1.4.2.2. Downloading Tomcat1.1.4.2.3. Installing Tomcat1.1.4.2.4. Adding an administrative user and password on a Linux system1.1.4.2.5. Starting and shutting down Tomcat 51.1.4.2.6. Verifying your Tomcat 5 installation1.1.4.3. How It Works1.1.4.4. How It Works1.1.4.4.1. Tags and taglib1.1.4.4.2. JSP's rapid development cycle1.1.4.4.3. Authentication for Manager access1.1.4.5. How It Works1.2. Summary1.3. Exercises
2. JSP Basics 1: Dynamic Page Creation for Data Presentation
2.1. The Anatomy of a JSP Page2.1.1. Directives2.1.2. XML-compatible syntax2.1.3. Template data2.1.4. Action2.1.5. Scripting elements2.1.6. Handling HTML form submission with JSP2.1.6.1. GET versus POST2.1.6.2. How It Works2.1.6.2.1. Using the GET method to submit a form2.1.6.2.2. Working with JSTL 1.12.1.6.2.3. Working with the JSP 2.0 Expression Language (EL)2.1.6.2.4. EL implicit objects2.1.6.3. How It Works2.1.6.3.1. JSP best practices2.1.6.3.2. Using the <jsp:include> standard action to select portal rendering2.1.6.3.3. Manipulating JavaBeans with JSP standard actions2.1.6.3.4. Rendering a multivalued JavaBean property with JSTL/EL2.1.7. Web site personalization2.1.7.1.2.1.7.1.1. Observing HTTP GET method URL encoding2.1.7.1.2. Vulnerability of the HTTP GET method of form submission2.1.7.2. How It Works2.1.7.2.1. Passing parameters to included JSPs2.1.7.2.2. Modifying the included JSP to use personalization data2.2. Summary2.3. Exercises
3. JSP Basics 2: Generalized Templating and Server Scripting
3.1. Scripting Elements for Java Code Embedding3.1.1. Scripting elements3.1.1.1. Declaration scripting elements3.1.1.1.1. Working with jspInit() and jspDestroy()3.1.1.2. Expression scripting element3.1.1.3. Scriptlet scripting element3.1.1.4. Java class syntax and scripting elements layout3.2. Creating a Simple Web Storefront3.2.1.3.2.1.1. How It Works3.2.2. Attaching attributes to implicit objects3.2.3. Rendering the list of categories3.2.4. Rendering the list of products in a given category3.3. Adding a Shopping Cart to a Catalog3.3.1.3.3.1.1. How It Works3.4. Creating the Shopping Cart3.4.1. Decoding incoming request parameters3.4.2. Rendering order information3.4.3. Rendering the Return to Shopping hyperlink3.4.4. Shopping cart limitations3.4.5. Overcoming the shopping cart limitations3.4.5.1. How It Works3.4.6. Sessions and JSPs3.4.6.1. Session implementation3.4.6.2. Using a session to track line items in a shopping cart3.4.7. Rendering the shopping cart using a session attribute3.4.7.1. Rendering the total order price and the Clear the Cart hyperlink3.4.7.2. Scoping of implicit objects in JSP3.5. Summary3.6. Exercises
4. CSS, JavaScript, VBScript, and JSP
4.1. Code Elements That Execute on the Client Side4.1.1. Cascading Stylesheets4.1.2. JavaScript4.1.3. VBScript4.2. User Preference Implementation4.2.1.4.2.1.1. How It Works4.2.1.2. Adding user preference form fields4.2.1.3. Dynamic generation of CSS stylesheet content4.2.1.4. Decoding form parameters and setting style variables4.3. Creating a User-Customizable DHTML Menu4.3.1.4.3.1.1. How It Works4.3.1.2. Customizing the DHTML menu with user color and font preferences4.3.1.3. Generating JavaScript code with JSP for the DHTML menu4.4. Summary4.5. Exercises

5. JSP and EL
5.1. EL and Its Vital Role in JSP5.2. EL Named Variables5.3. Applying EL5.3.1. Using EL expressions inline with template data5.3.2. Using EL expressions in attribute values5.3.2.1. How It Works5.3.2.1.1. Operators5.3.2.1.2. Arithmetic operators5.3.2.1.3. Logical operators5.3.2.1.4. Comparison operators5.3.2.1.5. The empty operator5.3.2.1.6. Boolean variables and nulls5.4. Coercion: Automatic Type Conversion5.4.1. Boxing and unboxing5.4.2. Coercion to a string5.4.3. Coercion to a number5.4.4. Coercion to a character5.4.5. Best attempt to "do the right thing" without error5.4.5.1. How It Works5.5. Accessing Object Properties and Collections5.5.1.5.5.1.1. How It Works5.6. Implicit EL Objects in JSP 2.05.6.1.5.6.1.1. How It Works5.7. User-Supplied Functions within EL5.7.1. Namespace and EL functions5.7.2. Static methods of a Java class5.7.2.1. How It Works5.7.2.1.1. Deployment descriptor entries5.7.2.1.2. TLD function definitions5.8. Summary5.9. Exercises
6. JSP Tag Libraries and JSTL
6.1. The Vital Role of JSP Tag Libraries6.2. The JSP Standard Tag Library6.3. Anatomy of a Tag Library6.3.1. The Tag Library Descriptor6.3.2. The taglib map in the web.xml deployment descriptor6.3.3. Locating JSTL and understanding tag library packaging6.3.4. JSTL tags6.3.4.1. Core tags6.3.4.2. Formatting tags6.3.4.3. XML tags and SQL tags6.3.4.4. How It Works6.3.4.4.1. Eliminating scripting declarations6.3.4.4.2. Declaring taglib usage6.3.4.4.3. Converting static method calls to EL accessible functions6.3.4.4.4. Replacing scripting iteration with the JSTL iteration tag6.3.4.4.5. JSTL's versatile URL creation tag6.3.4.5. How It Works6.3.4.5.1. Declaring constants with <c:set>6.3.4.5.2. Replacing complex Java scripting logic6.3.4.5.3. Converting control flow6.3.4.5.4. Converting method calls6.3.4.5.5. Changing the lineitems table layout6.3.4.5.6. A Common JSTL coding errors6.4. Summary6.5. Exercises
7. JSP Directives
7.1. Directive Basics7.1.1. Directives as instructions for the container7.1.2. Alternative XML syntax for directives7.1.3. Available JSP directives7.1.3.1. Processing a JSP page: the container's perspective7.2. The page Directive7.2.1. The language attribute7.2.2. The extends attribute7.2.3. The import attribute7.2.4. The session attribute7.2.5. The info attribute7.2.6. The isELIgnored attribute7.2.7. The isErrorPage attribute7.2.8. The errorPage attribute7.2.9. The contentType attribute7.2.9.1. How It Works7.2.9.1.1. The effect of varying content type7.3. The taglib Directive7.3.1. Two general usage forms for the taglib directive7.3.1.1. Using a URI to map to the tag library7.3.1.2. Specifying the directory of the tag files directly7.3.2. Attributes of the taglib directive7.3.2.1. How It Works7.3.2.1.1. A JSP using tags without the taglib directive!7.3.2.1.2. The <include-prelude> and <include-coda> elements7.4. The include Directive7.4.1. The include performed at translation time7.4.1.1. How It Works7.4.1.1.1. How the include directive and the <jsp:include> standard action differ7.4.1.1.2. Translation-time detection of errors versus request-time detection of errors7.4.1.2. Converting the index.jsp file into XML form7.4.1.2.1. Converting directives to XML syntax7.5. Summary7.6. Exercises
8. JSP Standard Actions
8.1. JSP Standard Actions Are Built-in Tags8.2. Actions for Working with JavaBeans8.2.1. The <jsp:useBean> standard action8.2.1.1. Using the <jsp:useBean> standard action8.2.1.2. How It Works8.2.1.2.1. Searching for a scoped named attribute8.2.1.2.2. Container-generated Java source code8.2.1.2.3. Synchronizing a Java reference with an attached attribute8.2.1.2.4. Using a JavaBean in scripting elements8.2.1.2.5. Using a JavaBean in an EL expression8.2.1.2.6. Effect of the type attribute in <jsp:useBean>8.2.1.3. The <jsp:setProperty> standard action8.2.1.4. How It Works8.2.1.4.1. Expediting form processing with <jsp:setProperty>8.2.1.4.2. Using the "*" special value for the <jsp:setProperty> standard action8.2.1.4.3. The <jsp:getProperty> standard action8.2.1.4.4. Rendering property values using EL expressions8.2.2. How <jsp:useBean> and JSTL <c:set> Differ8.3. Including JSP Output via <jsp:include>8.3.1.8.3.1.1. How It Works8.3.1.1.1. How the <%@ include %> directive and the <jsp:include> action differ8.3.1.1.2. Effects of nested includes8.3.1.1.3. Adding parameters to a <jsp:include> action8.4. Transferring Control Between JSPs8.4.1. The <jsp:forward> standard action8.5. Specifying Parameters for Other Actions8.5.1. The <jsp:param> standard action8.6. Working with Plug-ins8.6.1. The <jsp:plugin> standard action8.6.2. The <jsp:params> standard action8.6.3. The <jsp:fallback> standard action8.6.3.1. How It Works8.6.3.1.1. Generating parameters for the applet8.6.3.1.2. Handling user color selection8.6.3.1.3. Processing the color parameter8.6.3.1.4. Rendering alternative output for browsers without applet support8.6.3.1.5. HTML generated by <jsp:plugin>8.6.3.1.6. Practical real-world use of <jsp:plugin>8.7. Standard Actions Specific to Tag Files8.8. Summary8.9. Exercises
9. JSP and JavaBeans
9.1. Anatomy of a JavaBean9.1.1. JavaBean Properties9.1.1.1. Coding JavaBean properties9.1.2. JavaBean methods9.1.2.1. Invoking JavaBean methods using scriptlets9.1.2.2. Scriptless JSP and EL functions9.1.3. Common JavaBean packaging9.1.3.1. How It Works9.1.3.1.1. Switching requests through a front controller9.1.3.1.2. The index.jsp front controller9.1.3.1.3. Forwarding to different targets9.1.3.1.4. JavaBean flow for validation error reporting9.1.3.1.5. Accessing JavaBeans using standard actions9.1.3.1.6. The validation error information JavaBean9.1.3.1.7. The enterbid.jsp target9.1.3.1.8. Displaying bid information via a JavaBean9.1.3.1.9. Formatting auction output pages with a CSS stylesheet9.1.3.2. How It Works9.1.3.2.1. The Bidder JavaBean9.1.3.2.2. Modifying the controller to fetch bidding results9.2. How JavaBeans and EJBs Differ9.3. Summary9.4. Exercises
10. Error Handling
10.1. Understanding the Origin of Errors10.1.1. Errors in Java language coding10.1.2. Errors in scripting elements10.1.2.1. How It Works10.1.3. Errors in JSP directives and actions10.1.3.1. How It Works10.1.3.1.1. Errors in the <%@page %> directive10.1.3.1.2. Errors in the <jsp:include> action10.1.3.1.3. Translation-time errors versus request-time errors10.1.3.1.4. Handling request-time errors in JSP10.1.3.2. How It Works10.1.3.3. How It Works10.1.3.3.1. Java exceptions and JSP error handling10.1.3.3.2. Accessing error information in an error-handling page10.1.4. JSTL errors and EL errors10.1.5. User data-input errors10.1.6. Errors found in JSP template data10.2. Summary10.3. Exercises
11. Building Your Own Custom JSP Tag Library
11.1. What Is a Tag File?11.2. A Simple Tag File: Displaying Today's Date11.3. Advantages of Tag Files11.3.1. Code reuse11.3.2. Hiding complexity11.3.3. Separation of concerns11.3.4. Simplicity11.3.5. Flexible packaging11.4. Developing Tag Files11.4.1. Scope and implicit objects11.4.2. Using directives in tag files11.4.2.1. tag11.4.2.2. taglib11.4.2.3. include11.4.2.4. attribute11.4.2.5. variable11.4.2.5.1. Variable scope11.4.3. Body processing11.4.3.1. jsp:doBody11.4.3.2. How It Works11.4.4. Attributes11.4.4.1. Simple attributes revisited11.4.4.2. How It Works11.4.4.3. Fragment attributes11.4.4.4. How It Works11.4.4.5. How It Works11.4.4.6. Dynamic attributes11.5. Packaging Tag Files11.5.1.11.5.1.1. How It Works11.5.2. Java custom actions versus tag file custom actions11.5.2.1. Complexity of the problem11.5.2.2. Team skills and alien artifacts11.6. Summary11.7. Exercises
12. Advanced Dynamic Web Content Generation
12.1. Data Validation in Web Applications12.1.1. Server-side validation and efficient usage of resources12.1.2. Client-side data validation12.1.3. The need for server-side validation12.1.4. Common client-side validation scenarios12.1.5. Operation of client-side validation12.1.5.1. The client-side scripting language12.1.5.2. How It Works12.1.5.2.1. Using a front controller to forward requests12.1.5.2.2. JavaScript for client-side validation12.1.5.2.3. Using the hidden <span> tag to reveal multiple validation errors12.1.5.2.4. Client-side validation prior to form submission12.1.5.2.5. Displaying product data12.1.6. Dynamic generation of client-side JavaScript code12.1.6.1. How It Works12.1.6.1.1. Using a custom tag library for client-side data validation12.1.6.1.2. Tag library implementation details12.1.7. Dynamic generation of XML using JSP12.1.7.1. How It Works12.1.7.1.1. Escaping reserved characters when generating XML12.1.7.1.2. The <my:getInfo> custom tag12.2. Summary12.3. Exercises
13. Internationalization and Localized Content
13.1. About Internationalization-Ready Applications13.2. Internationalization and Localization13.2.1. The unique i18n requirements of a Web-based JSP application13.3. Building on the Java Platform's i18n Capabilities13.3.1. The concept of a locale13.3.2. Maintaining locale information13.3.2.1.13.3.2.1.1. Working with the English localization13.3.2.1.2. Working with the Chinese localization13.3.2.2. How It Works13.3.2.2.1. Explicit user selection of locale13.3.2.2.2. Linking to the English form13.3.2.2.3. Linking to the Chinese form13.3.2.2.4. Handling i18n using duplicated sets of translated pages13.3.2.2.5. The localized English pages13.3.2.2.6. The localized Chinese pages13.3.2.2.7. Trying out the English pages13.3.2.2.8. Trying out the Chinese localization13.3.2.3. How It Works13.3.2.4. Java 2 resource bundles13.3.2.5. Creating a resource bundle13.3.2.6. How Java 2 selects i18n strings13.3.2.7. Creating the Chinese l10n properties file13.3.2.8. The Locale selection page13.3.2.9. Generating a localized form using JSP13.3.2.10. JSTL tags that support i18n13.3.2.11. Applying the JSTL i18n tags13.3.2.12. Creating an i18n-ready form processing JSP13.3.2.13. Setting request parameter encoding13.3.2.14. Determining a user's locale automatically (almost!)13.3.2.15. How It Works13.3.2.16. How It Works13.4. Summary13.5. Exercises
14. JSP Debugging Techniques
14.1. The Science of Debugging14.1.1.14.1.1.1. How It Works14.2. Catching Bugs at Compile Time14.2.1.14.2.1.1. How It Works14.2.1.2. How It Works14.3. Using a Debugging System versus a Production System14.4. Using System.out.println() to Instrument Code14.4.1.14.4.1.1. How It Works14.5. Using a Logging System14.5.1. Logging through the servlet container14.5.1.1. How It Works14.5.2. Logging with the JDK logger14.5.2.1. How It Works14.5.2.2. Using the LogManager class14.5.2.3. Loggers and logging levels14.5.2.4. Handlers14.5.2.5. Configuring the SDK logging framework14.5.2.6. How It Works14.5.2.7. How It Works14.5.3. Logging with Log4j14.5.3.1. Appenders and Layouts14.5.3.2. Configuring Log4j14.5.3.3. How It Works14.5.3.4. Changing the Log4j configuration without restarting the container14.5.4. Logging with tag libraries14.5.4.1. How It Works14.6. Debugging with Tools14.6.1. Setting breakpoints14.6.2. Examining variables and setting watchpoints14.6.3. Stepping through code14.6.4. Remote debugging14.7. Debugging Code in Production Environments14.7.1. Debugging when the JSP is precompiled14.7.2. Debugging under load14.7.3. Adding contextual information to log files14.7.4. Adding log filters14.8. Finding the Intermittent Problem14.8.1. Adding information as response comments14.8.2. Snoop application14.9. Avoiding Concurrency Issues14.10. Summary14.11. Exercises
II. JSP and Modern Web Server Software Development
15. JSPs and Servlets
15.1. A JSP Is a Servlet15.1.1.15.1.1.1. How It Works15.1.2. Anatomy of a servlet15.1.2.1. The mark of a servlet: the javax.servlet.Servlet interface15.1.2.2. Implementing the Servlet interface through the helper HttpServlet class15.1.2.3. Overriding methods that you want to implement15.1.2.4. Delegating processing to a common helper method15.1.2.5. The init() and destroy() methods15.1.3. The lifecycle of a servlet15.1.4. Describing servlets to containers in the deployment descriptor15.1.5. The servlet declaration15.1.5.1. The servlet mapping15.1.5.2. How It Works15.1.6. Using servlets when JSP is available15.1.7. Specifying initialization parameters15.1.8. Accessing initialization parameters within the ControllerServlet15.1.9. Custom forwarding of incoming requests via the controller servlet15.1.10. The forwarding targets15.2. Summary15.3. Exercises
16. The Role of JSP in the Wider Context: Web Applications
16.1. What Is a Web Application?16.2. Directory Structure for a Web Application16.3. The Deployment Descriptor16.3.1. Deployment descriptor elements for a JSP developer16.3.1.1. Common JSP16.3.1.1.1. context-param16.3.1.1.2. welcome-file-list16.3.1.1.3. error-page16.3.1.2. Enterprise JSP16.3.1.2.1. login-config16.3.1.2.2. security-constraint16.3.1.2.3. security-role16.3.1.2.4. env-entry16.3.1.2.5. resource-ref16.3.1.2.6. servlet and servlet-mapping16.4. Using a Web Archive16.5. Development and Deployment Strategies16.6. Packaging and Deploying for Tomcat16.6.1.16.6.1.1. How It Works16.6.1.2. How It Works16.6.2. Introduction to Web application security16.6.2.1. How It Works16.7. Summary16.8. Exercises
17. Model View Controller
17.1. What Is MVC?17.2. MVC and Web Applications17.2.1.17.2.1.1.17.2.1.1.1. Controller: SimpleController17.2.1.1.2. Model: Customer17.2.1.1.3. View: displayList.jsp17.2.1.1.4. Selecting a single customer for display17.3. Summary17.4. Exercise
18. Web Frameworks
18.1. What Is a Framework?18.2. Why Frameworks Are Good18.3. Types of Frameworks18.3.1. Application frameworks18.3.1.1. Architectural patterns18.3.1.2. Validation mechanisms18.3.1.3. Internationalization18.3.1.4. Templating18.3.2. Persistence frameworks18.3.3. Utility frameworks18.4. WebWork18.4.1. Components of WebWork18.4.1.1. Dispatchers18.4.1.1.1. ServletDispatcher18.4.1.1.2. GenericDispatcher18.4.1.1.3. ClientDispatcher18.4.1.2. Views18.4.1.2.1. JSP18.4.1.2.2. Velocity18.4.1.2.3. XSLT18.4.1.2.4. Jasper Reports18.4.1.3. WebWork example18.4.1.4. Installation18.4.1.5. Example applications18.4.1.6. Skeleton application18.4.1.6.1. FormTest class18.4.1.6.2. formtest.jsp18.4.1.6.3. web.xml18.4.1.6.4. webwork.properties18.4.1.6.5. views.properties18.4.1.6.6. Enhancements18.5. The Spring Framework18.5.1. Main components of the Spring MVC18.5.1.1. Controllers and commands18.5.1.2. Validators18.5.1.3. Views18.5.1.4. Internationalization18.5.2. An example using Spring18.5.2.1. Installation18.5.2.2. Base application description18.5.2.2.1. Controller: TestFormController18.5.2.2.2. Model: TestForm18.5.2.2.3. Validator: TestFormValidator18.5.2.2.4. Resources: messages.properties18.5.2.2.5. Views: form.jsp and success.jsp18.5.2.2.6. Enhancements18.5.2.3. How It Works18.6. Summary18.7. Exercises
19. Struts Framework
19.1. Introducing Struts19.1.1. A Struts walkthrough19.1.2. Controller: actions and forms19.1.2.1. Actions19.1.2.2. Forms19.1.2.3. DynaActionForm19.1.3. Model19.1.4. View19.1.4.1. Form bean interaction19.1.4.2. Internationalization19.1.4.3. Struts Tag Library19.1.4.3.1. HTML form tags19.1.4.3.2. Other HTML tags19.1.4.3.3. Logic tags19.1.4.3.4. Bean tags19.1.4.4. Validation19.1.4.4.1. Form bean validation19.1.4.4.2. Struts Validator19.1.4.4.3. Defining the validation rules19.1.4.4.4. Business logic validation19.1.5. Example application19.1.5.1. How It Works19.1.5.2. Adding enhancements19.1.5.3. How It Works19.1.5.4. How It Works19.1.5.5. How It Works19.2. Summary19.3. Exercises
20. Layout Management with Tiles
20.1. Introduction to Tiles20.1.1. What is the Tiles framework?20.1.2. Tiles terminology20.1.2.1. Layout20.1.2.2. Tile20.1.2.3. Definition20.1.3. Installing Tiles20.1.3.1. How It Works20.2. Tile Scope20.3. Definitions20.4. Tiles Tags20.4.1. insert20.4.2. definition20.4.3. put20.4.4. putList20.4.5. add20.4.6. get20.4.7. getAsString20.4.8. useAttribute20.4.9. importAttribute20.4.10. initComponentDefinitions20.5. Passing Parameters to Tiles20.6. Advanced Tiles20.6.1. Definitions and inheritance20.6.1.1. How It Works20.6.2. Nesting tiles20.6.2.1. How It Works20.6.2.2. How It Works20.7. Tiles and Struts20.7.1. Configuring Tiles with Struts20.7.2. Tiles definitions as action forwards20.7.3. Passing values from Struts to Tiles20.7.3.1. How It Works20.8. Summary20.9. Exercises
21. JavaServer Faces
21.1. Configuring a JSF Project21.2. Getting Started with JSF21.2.1.21.2.1.1. How It Works21.2.1.2. How It Works21.2.2. Using backing beans21.2.2.1. How It Works21.2.3. Managed beans21.2.4. Controlling navigation21.2.4.1. How It Works21.2.5. Preventing direct access to Faces JSP files21.3. JSF Lifecycle21.3.1. Restore view21.3.2. Apply request values21.3.3. Process validations21.3.4. Update model values21.3.5. Invoke application21.3.6. Render response21.4. Validating Data21.4.1.21.4.1.1. How It Works21.4.2. Using standard validators21.4.3. Creating your own validation21.4.3.1. Implementing the Validator Interface21.4.3.2. How It Works21.4.3.3. Creating a custom validator tag21.4.3.4. How It Works21.4.3.5. How It Works21.4.3.6. Using the backing bean21.5. Converting Data21.5.1.21.5.1.1. How It Works21.5.2. Standard converters21.5.2.1. Converting dates and times21.5.2.2. Converting numbers21.5.3. Implementing the Converter interface21.5.3.1. How It Works21.6. Handling Events with Listeners21.6.1.21.6.1.1. How It Works21.6.1.2. How It Works21.7. JSF versus Struts21.8. Summary21.9. Exercises
22. JSP in J2EE
22.1. Overview of J2EE22.1.1. What is J2EE?22.1.2. What does a container do?22.2. J2EE Technologies22.2.1. J2EE APIs22.2.2. J2EE platform architecture22.2.3. JSP development scenarios22.3. Using JSP with J2EE Components22.3.1. Servlets22.3.1.1. Servlet example22.3.1.2. How It Works22.3.2. JNDI22.3.2.1. How It Works22.3.3. JDBC22.3.3.1. JDBC example22.3.3.2. How It Works22.4. EJB22.4.1. Benefits of EJB22.4.2. Restrictions on EJB22.4.3. Types of EJB22.4.4. Session beans22.4.5. Entity beans22.4.6. Message-driven beans22.4.7. Timer Service22.5. Summary22.6. Exercises
23. Access to Databases
23.1. Introduction to Databases23.1.1. Connecting to a database23.1.1.1. Type 1: JDBC-ODBC bridge23.1.1.2. Type 2: Native API/Partly Java driver23.1.1.3. Type 3: Net Protocol/All Java driver23.1.1.4. Type 4: Native Protocol/All Java driver23.1.1.5. Using a JDBC driver23.1.2. Downloading and Installing MySQL23.1.2.1. Downloading MySQL23.1.2.2. Installing MySQL23.1.2.3. Installing the JDBC driver23.1.2.4. Starting MySQL23.1.3. JDBC APIs23.1.3.1. java.sql packages23.1.3.2. javax.sql23.1.3.3. JDBC connection and database access23.1.3.4. JDBC data types23.1.3.4.1. Creating a database23.1.3.5. Creating the roster administration23.1.3.5.1. Web application directory setup23.1.3.5.2. Creating the administration servlet23.1.3.6. How It Works23.1.3.7. How It Works23.1.3.7.1. Running the application23.2. Building Applications23.2.1. Data characteristics23.2.2. Transactions23.2.2.1. Effects of transactions23.2.3. Object-relational mapping23.3. Different Types of Applications23.3.1. Simple applications23.3.2. Using JSP and JDBC23.3.2.1. How It Works23.3.3. More complex applications23.4. Using Hibernate23.4.1. Installing Hibernate23.4.1.1. How It Works23.4.1.2. How It Works23.4.1.3. How It Works23.4.1.3.1. Managing object relationships with Hibernate23.4.1.4. How It Works23.5. Summary
24. Security
24.1. Areas of Security24.1.1. Authentication24.1.2. Authorization24.1.3. Data integrity24.1.4. Confidentiality24.2. Data Integrity and Confidentiality24.2.1. Implementing SSL24.2.1.1. Obtaining JSSE24.2.1.2. Creating keys and certificates24.2.1.3. How It Works24.2.1.4. Configuring Tomcat24.2.1.5. How It Works24.3. Authentication24.3.1. HTTP BASIC authentication24.3.1.1. How It Works24.3.2. Form-based authentication24.3.2.1. How It Works24.3.2.2. How It Works24.3.3. Client-certificate authentication24.3.3.1. Personal certificates24.3.3.2. How It Works24.3.3.3. How It Works24.4. Authorization24.4.1. Container24.4.2. Programmatic24.4.2.1. How It Works24.5. Summary24.6. Exercises
25. Performance
25.1. Performance Concepts25.1.1. What to measure25.1.2. The user's perspective25.1.3. How to measure performance25.1.4. What to do after performance testing25.2. Measuring Performance Using JMeter25.2.1. Installing JMeter25.2.2. JMeter concepts25.2.2.1. How It Works25.3. Performance Tuning Tips25.3.1. Development-time measures25.3.1.1. Avoid creating sessions for JSPs if not required25.3.1.2. Session objects should be small in size25.3.1.3. Time out sessions quickly25.3.1.4. Use the right scope for objects25.3.1.5. Use connection pooling for performance25.3.1.6. Cache data25.3.1.7. Use transfer objects25.3.1.8. Minimize logging25.3.2. Deployment-time measures25.3.2.1. Precompile JSPs25.3.2.2. JSP modification-time checks25.3.2.3. Custom tag pooling25.3.2.4. Using Web servers for static content25.4. Summary
26. Best Practices and Tools
26.1. Development Methodologies26.1.1. Waterfall and iterative methodologies26.1.2. Rational Unified Process26.1.3. Extreme Programming26.1.4. Test-driven development26.1.5. Feature-driven development26.2. Development Tools26.2.1. Version-control tools26.2.2. Build tools26.2.3. Testing tools26.2.4. Logging tools26.2.5. Tools for enforcing coding standards26.3. Apache Ant26.3.1. Installing Ant26.3.2. Ant concepts26.3.2.1. Ant tasks26.3.3. Additional resources26.4. CVS26.4.1. Installing CVS26.4.2. CVS concepts26.4.3. Connecting to a CVS server26.4.4. Checking in code26.4.5. Checking out code26.4.6. Comparing changes across revisions26.4.6.1. Managing code versions through Ant scripts26.4.7. Additional resources26.5. JUnit26.5.1. Installing JUnit26.5.2. JUnit concepts26.5.2.1. Running JUnit tests from Ant scripts26.5.3. Additional resources26.6. HttpUnit26.6.1. Installing HttpUnit26.6.2. HttpUnit concepts26.6.3. Additional resources26.7. Best Practices for Web Development26.7.1. Follow good JSP coding practices26.7.2. Separate application logic and presentation26.7.3. Use design patterns where appropriate26.7.4. Use frameworks for developing applications26.7.5. Early testing and integration26.8. Summary26.9. Exercises
III. Spreading Your New Wings: Applying JSP in the Real World
27. JSP Project I: Personalized Portal
27.1. The Portal Project27.1.1. Introduction to RSS27.1.1.1. The Importance of RSS27.1.2. Introduction to Web services27.1.2.1. The Importance of Web services27.1.2.1.1. Enterprise application integration27.1.2.1.2. Web sites as applications27.2. Project Features27.2.1. Use cases27.2.2. Initial analysis27.3. The Application Design27.3.1. Designing the persistent store27.3.2. Defining the key entity objects27.3.3. Designing the Web site control flow27.4. The Development Environment27.4.1. Directory structure27.4.2. Build scripts27.4.3. Struts27.4.4. Tiles27.4.5. Log4j27.4.6. Rome27.4.7. Apache Axis27.5. The Application27.5.1. View27.5.2. Controller27.5.3. Running the portal application27.6. Summary27.7. Exercises
28. JSP Project II: Shopping Cart Application
28.1. The Bookstore Project28.1.1. Project features28.1.2. Use cases28.1.3. Initial analysis28.2. Application Design28.2.1. Database design28.2.2. Defining the key entity objects28.2.2.1. BaseEntity28.2.2.2. CustomerOrder28.2.2.3. OrderItem28.2.2.3.1. OrderStatus28.2.2.4. Category28.2.2.5. Book28.2.2.5.1. ShoppingCart28.2.2.6. Persistence management design28.2.2.6.1. SessionProvider28.2.2.6.2. EntityManager and EntityManagerFactory28.2.2.7. Controller object design28.3. The Development Environment and Its Configuration28.3.1. Directory structure28.3.1.1. Packages28.3.2. Tomcat28.3.3. Ant28.3.3.1. Properties customization28.3.3.2. Classpath28.3.3.3. Runtime resources28.3.3.4. Targets28.3.4. Database28.3.5. Hibernate28.3.5.1. Book.hbm.xml28.3.5.2. Category.hbm.xml28.3.5.3. CustomerOrder.hbm.xml28.3.5.4. OrderItem.hbm.xml28.3.5.5. OrderStatus.hbm.xml28.3.6. Struts, Validator, and Tiles28.3.7. web.xml28.4. The Application28.4.1. Application layout: Tiles28.4.1.1. Menu tile definition28.4.2. Cart status28.4.3. Presenting a list of categories28.4.4. Presenting a list of books28.4.5. Adding a book to the shopping cart28.4.6. Managing the shopping cart28.4.7. Checkout28.4.7.1. Validation28.4.7.2. Saving the order28.5. Summary28.6. Exercises
IV. Appendixes
A. JSP Syntax Reference
A.1. ScopingA.1.1. page scopeA.1.2. request scopeA.1.3. session scopeA.1.4. application scopeA.2. Implicit ObjectsA.2.1. The request objectA.2.2. The response objectA.2.3. The pageContext objectA.2.4. The session objectA.2.5. The application objectA.2.6. The out objectA.2.7. The config objectA.2.8. The page objectA.2.9. The exception objectA.3. DirectivesA.3.1. The page directiveA.3.2. The taglib directiveA.3.3. The include directiveA.3.4. Tag file directivesA.3.4.1. The tag directiveA.3.4.2. The attribute directiveA.3.4.3. The variable directiveA.4. ActionsA.4.1. Standard actionsA.4.1.1. The <jsp:useBean> actionA.4.1.2. The <jsp:setProperty> actionA.4.1.3. The <jsp:getProperty> actionA.4.1.4. The <jsp:include> actionA.4.1.5. The <jsp:forward> actionA.4.1.6. The <jsp:params> actionA.4.1.7. The <jsp:p aram> actionA.4.1.8. The <jsp:plugin> actionA.4.1.9. The <jsp:fallback> actionA.4.2. Other JSP standard actionsA.5. Scripting ElementsA.5.1. Declaration scripting elementsA.5.2. ScriptletsA.5.3. Expression scripting elements
B. JSP Expression Language Reference
B.1. EL ExpressionsB.1.1. EL expressions in-line with template dataB.1.2. EL expressions in attribute valuesB.2. Accessing Arrays, Maps, Object Properties, and CollectionsB.2.1. Object properties accessB.2.2. Array member accessB.2.3. Java map accessB.2.4. Java collection accessB.3. Elements of EL ExpressionsB.3.1. Named variablesB.3.2. LiteralsB.3.3. OperatorsB.3.3.1. Arithmetic operatorsB.3.3.2. Logical operatorsB.3.3.3. Comparison (relational) operatorsB.3.3.4. The empty operatorB.3.4. Operator precedenceB.3.5. FunctionsB.3.5.1. Namespace and EL functionsB.3.5.2. EL function implementation: static methods of a Java classB.4. Type ConversionsB.4.1. Coercion: automatic type conversionB.4.1.1. Boxing and unboxingB.4.1.2. Coercion to StringB.4.1.3. Coercion to NumberB.4.1.4. Coercion to CharacterB.5. Implicit ObjectsB.5.1. The pageContext implicit objectB.5.2. The pageScope implicit objectB.5.3. The requestScope implicit objectB.5.4. The sessionScope implicit objectB.5.5. The applicationScope implicit objectB.5.6. The param implicit objectB.5.7. The paramValues implicit objectB.5.8. The header implicit objectB.5.9. The headerValues implicit objectB.5.10. The cookies implicit objectB.5.11. The initParam implicit object
C. JSTL Reference
C.1. JSTL Core TagsC.1.1. catchC.1.2. chooseC.1.3. ifC.1.4. importC.1.5. forEachC.1.6. forTokensC.1.7. outC.1.8. otherwiseC.1.9. paramC.1.10. redirectC.1.11. removeC.1.12. setC.1.13. urlC.1.14. whenC.2. JSTL XML TagsC.2.1. chooseC.2.2. forEachC.2.3. ifC.2.4. otherwiseC.2.5. outC.2.6. paramC.2.7. parseC.2.8. setC.2.9. transformC.2.10. whenC.3. JSTL Formatting TagsC.3.1. bundleC.3.2. formatDateC.3.3. formatNumberC.3.4. messageC.3.5. paramC.3.6. parseDateC.3.7. parseNumberC.3.8. requestEncodingC.3.9. setBundleC.3.10. setLocaleC.3.11. setTimeZoneC.3.12. timeZoneC.4. JSTL SQL TagsC.4.1. dateParamC.4.2. paramC.4.3. queryC.4.4. setDataSourceC.4.5. transactionC.4.6. updateC.5. JSTL FunctionsC.5.1. containsC.5.2. containsIgnoreCaseC.5.3. endsWithC.5.4. escapeXmlC.5.5. indexOfC.5.6. joinC.5.7. lengthC.5.8. replaceC.5.9. splitC.5.10. startsWithC.5.11. substringC.5.12. substringAfterC.5.13. substringBeforeC.5.14. toLowerCaseC.5.15. toUpperCaseC.5.16. trim
D. Exercise Solutions
D.1. Chapter 1 ExercisesD.1.1. Exercise 1D.1.2. Exercise 2D.2. Chapter 2 ExercisesD.2.1. Exercise 1D.2.2. Exercise 2D.3. Chapter 3 ExercisesD.3.1. Exercise 1D.3.2. Exercise 2D.4. Chapter 4 ExercisesD.4.1. Exercise 1D.4.2. Exercise 2D.5. Chapter 5 ExercisesD.5.1. Exercise 1D.5.2. Exercise 2D.6. Chapter 6 ExercisesD.6.1. Exercise 1D.6.2. Exercise 2D.7. Chapter 7 ExercisesD.7.1. Exercise 1D.7.2. Exercise 2D.8. Chapter 8 ExercisesD.8.1. Exercise 1D.8.2. Exercise 2D.9. Chapter 9 ExercisesD.9.1. Exercise 1D.9.2. Exercise 2D.10. Chapter 10 ExercisesD.10.1. Exercise 1D.10.2. Exercise 2D.11. Chapter 11 ExercisesD.11.1. Exercise 1D.11.2. Exercise 2D.12. Chapter 12 ExercisesD.12.1. Exercise 1D.12.2. Exercise 2D.13. Chapter 13 ExercisesD.13.1. Exercise 1D.13.2. Exercise 2D.14. Chapter 14 ExercisesD.14.1. Exercise 1D.14.2. Exercise 2D.14.3. Exercise 3D.15. Chapter 15 ExercisesD.15.1. Exercise 1D.15.2. Exercise 2D.16. Chapter 16 ExercisesD.16.1. Exercise 1D.16.2. Exercise 2D.16.3. Exercise 3D.17. Chapter 17 ExercisesD.17.1. Exercise 1D.18. Chapter 18 ExercisesD.18.1. Exercise 1D.19. Chapter 19 ExercisesD.19.1. Exercise 1D.19.2. Exercise 2D.20. Chapter 20 ExercisesD.20.1. Exercise 1D.20.2. Exercise 2D.21. Chapter 21 ExercisesD.21.1. Exercise 1D.21.2. Exercise 2D.21.3. Exercise 3D.22. Chapter 22 ExercisesD.22.1. Exercise 1D.22.2. Exercise 2D.23. Chapter 24 ExercisesD.23.1. Exercise 1D.23.2. Exercise 2D.24. Chapter 26 ExercisesD.24.1. Exercise 1D.25. Chapter 27 ExercisesD.25.1. Exercise 1D.25.2. Exercise 2D.26. Chapter 28 ExercisesD.26.1. Exercise 1D.26.2. Exercise 2

Content preview from Beginning JavaServer Pages™

Chapter 24. Security

This chapter looks at one of the more challenging areas in Web application development, that of securing the Web application.

The chapter begins by examining security in general, and includes a breakdown of the term "security" into a number of different areas that can be addressed independently depending on the requirements of the Web application.

Next you will examine examples of how these security areas can be implemented using the Tomcat JSP and servlet container, and examples of use in JSP. This covers technologies such as SSL, and implementing different J2EE support authentication techniques such as basic, form, and client-certificate.

Finally, the chapter concludes with some examples of using programmatic authorization.

In particular, this chapter

Provides a general discussion about Web application security
Shows how to configure Tomcat with SSL
Shows examples of the J2EE-supported authentication types
Shows examples of programmatic authorization

Areas of Security

The security of Web applications is covered by a number of different areas. These areas will generally relate to different requirements for the Web application and the data that is used by the Web application. The sorts of questions that can be used to identify how and what should be secured are as follows:

Who is allowed to access the Web application?
How will you identify the users?
Are there any restrictions on where the application is accessed from?
Is any of the application data private?
can add/modify/delete ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9780764574856Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Beginning JavaServer Pages™

by Vivek Chopra, Sing Li, Rupert Jones, John T. Bell, Jon Eaves

Chapter 24. Security

Areas of Security

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.