JavaServer Pages, 3rd Edition

Mapping Application Requests to the Servlet

The first requirement for using a Controller servlet is that all requests must pass through it. This can be satisfied in many ways. If you have played around a bit with servlets previously, you’re probably used to invoking a servlet with a URI that starts with /myApp/servlet. This is a convention introduced by Sun’s Java Web Server (JWS), the first product to support servlets before the API was standardized. Some servlet containers still support this convention,^[5] even though it’s not formally defined in the servlet specification. But using this type of URI has a couple of problems. First, it makes it perfectly clear to a user (at least a user who knows about servlets) what technology implements the application. Not that you shouldn’t be proud of using servlets, but a hint like this can help a hacker explore possible security holes; it never hurts to be a bit paranoid when it comes to security. The other problem is of a more practical nature.

As I described in Chapter 17, using relative URIs to refer to resources within an application makes life a lot easier. If a servlet must be invoked using the conventional type of URI, you typically end up with absolute references to the servlet in HTML link and form elements, for example:

<form action="/ora/servlet/controller/someAction">

This works, but because the context path (/ora) is part of the URI, it makes it hard to deploy the application with a different context path; you have to change ...