Restrict GET/POST to a single servlet

I've seen what looked like this question asked several times on this newsgroup,
but nothing seems to match what I'm looking for. So I apologize if it has been
asked and answered.
Basically, I want to deploy a war file such that my front controller servlet is
the one and only URL that a user can type in to get anywhere. All of my JSP and
HTML files should be inaccessible through anything but a RequestDispatcher forward
or include command.
All that I have seen so far has to do with the <security-role> tag in web.xml,
but that just says that you must be validated before you can access a resource.
I want there to be no way to access this resource directly, regardless of authentication.
I already tried just putting my JSP and HTML files into a subdirectory of WEB-INF,
but then I was unable to get my RequestDispatcher to access them.
Does anyone know how to do this?
Thanks,
Andy

Andrew Byala wrote:
I've seen what looked like this question asked several times on this newsgroup,
but nothing seems to match what I'm looking for. So I apologize if it has been
asked and answered.
Basically, I want to deploy a war file such that my front controller servlet is
the one and only URL that a user can type in to get anywhere. All of my JSP and
HTML files should be inaccessible through anything but a RequestDispatcher forward
or include command.Try this technique:
http://www.servlets.com/archive/servlet/ReadMsg?msgId=119783&listName=advanced-servlets
Cheers,
Alex

Similar Messages

HTTP GET/POST: J2EE Design Strategy w.r.t servlet implementation

I am in process of designing a J2EE application with browser interface. I have thought of having "Front Controller" Servlet for all HTTP-GET requests and "Action Controller" servlet for all HTTP-POST requests.
I have worked this distinction on the basis that GET request maps directly to page being requested and POST request corresponds to action being performed on some page. Here in fact the design is driven by appropriate selection between GET or POST. So all possible requests on the site should get properly mapped to action or page.
Decision of two servlets is merely to divide the load on single servlet. There being well defined logical (page and action) and implementation (GET/POST) boundary, the division seems workable.
Before actually finalizing this decision I need to know any inputs (pros and cons) of this approach.
Further If I start mapping to actual scenerios,
Request for home page,
Request from HREFs,
Request where new transaction is started
will always be GET Requests.
However what about request method (POST or GET) for update employee profile page when emp. id is available already available on first page ??
And further
Is this GET/POST divison always possible ??
Any constraints that any one can see in this mapping ??
Any comments on the update employee profile scenerio - GET/POST - page/action ??
PS: Pl. discard error scenerios for the moment.

how would you direct the GET requests to one servlet and the POST requests to the other?
Wouldn't they need to pass thru' yet another servlet to decide which is which (GET or POST), and redirect them accordingly?
I would have both GET and POST handled by the same single-point-of-entry servlet. For example, not all data is sent to the server via a POST - you can send form data via a GET, using name/value pairs in the url.

HTTP GET/POST method support in ESB/BPEL

hi,
I want to call HTTP URL using GET/POST method from ESB or BPEL. Can you please tell me how this can be achieved?
Thanks,
Vaibhav

how would you direct the GET requests to one servlet and the POST requests to the other?
Wouldn't they need to pass thru' yet another servlet to decide which is which (GET or POST), and redirect them accordingly?
I would have both GET and POST handled by the same single-point-of-entry servlet. For example, not all data is sent to the server via a POST - you can send form data via a GET, using name/value pairs in the url.

CREMDM splitted by PI, ADRMAS gets posted, CREMAS in inbound queue

Hi all,
I am on SAP MDM 7.1 SP03, SAP PI and SAP ECC6.
I have gone thorugh all the threads and Guides related to MDM but couldn't find a valid solution for my problem described below. However, I did find some tricks and tweaking which I dont want to use as they are not recommended by SAP.
We syndicated NEW Vendor records being created in MDM using CREMDM with standard Syndication Map. We have Vendors number generated in MDM and the number range being used exists in ECC and is marked as external. Moreover, the number range uses all of 10 digits, so there is no question of Conversion Routines with it. We deployed PI for splitting CREMDM to ADRMAS and CREMAS. We have serialized ADRMAS to go before CREMAS. We have assured that fields common between these two, have "no data" character i.e. "/" in CREMAS with correct data in ADRMAS. And ADDR_GROUP is mapped as "BP".
Now the problem is, ADRMAS gets posted but CREMAS remains in the inbound queue. The queue running but still CREMAS remains there with CODE as "75". This results in non-creation od Vendor master record as CREMAS is not posted.
Can anybody help with this. I really appreciate the support.

Hi R,
The ALE inbound function modules treat each IDoc segment as a current set of data. Missing fields (or fields that have no data) are interpreted as a value deletion. To keep the existing value for a single field, you have to add a no-data sign as field value for NAME_1. This no-data sign is a single slash (/).
Please execute the inbound function module manually in WE19 to test this. If an exception is seen at NAME_1 ,pass a value or '/' and check for successful posting of Idoc.
If this works, modify inputs to CREMAS accordingly.
In addition a good SAP Note 1052964 - MDM: Distribution of Business Partners, Customers, Vendors for your reference.
Regards,
Vinay M.S

How to restrict the posting document from the parked user

Hi All,
Please help me in the below requirement
The requirement is, need to restrict the posting of document by the same user, who has parked the document.
For this I did the code changes in BTE: 00001140 by copying the function module:
u2018SAMPLE_INTERFACE_00001140u2019 into new function module asu2019 Y_IB_FI_PROCESS_00001140u2019
In this I have restricted as
IF ( sy-tcode = FV60 or
sy-tcode = FV50 or
    sy-tcode = FBV0 ).
IF i_parked = u2018xu2019. " document has already been parked
      READ TABLE t_bkpf INDEX 1.
      IF t_bkpf-usnam EQ sy-uname. " park user = current user ?
        t_exctab-okcod = 'BU'.    " do not allow to post
        APPEND t_exctab.
      ENDIF.
    ENDIF.
This function module is getting trigger while parking and posting the documents
While posting the document, the parameter i_parkedu2019 is not getting the values as u2018Xu2019,
To get the values as u2018Xu2019 for the parameter: i_parked what can I do?
Can you please help me, is there configuration side need check?
Or do I need to write code some where else.
Thanks in Advance
Rambabu .A
Cross-post

Hi
Well, in such a case, it might be justified... BUt again, I would ask how would you differentiate between What USER1 can park and what can he post?... Certainly, it would be by means of fields like Doc Type, etc...
Else, if you leave it to the discretion of USER1 and give him both the authorizations, why would he like to park when he can post the doc?
Anyways, now coming to the BTE, each BTE uses a structure... For eg: BTE 1120 uses BSEG_SUBST... If the fields you desire are not available in the structure, then you can also enhance the structure... See if you can enhance the structures involved and achieve the result
Regards
Ajay M

Wage type getting posted to wrong GL

Hello,
We have a problem with the Posting Program.
We have defined a service category field in the Org assignment infotype.(Indirect/Direct) based upon which the employee's salary gets posted to either Indirect GL or Direct GL's.
This functionality works fine in case the Posting program is run for single employee.However,when it is run for the entire Personnel subarea then for one particular employee salary is getting posted to wrong GL(Employee's service category is direct but the salary is getting posted to indirect GL).
Could anyone please help me understand what could be the possible reason behind this and how to fix it.
Thanx
Sushil

Hi
If it is happening with only one employee
Check the employee data once again
while asign the Master cost center....... which display in the infotype 0001 and also check if any entries are maintained in the Infotype 0027
Hope it will help
Regards
rajeshk

Http: get post. HELP!!!

I'm trying to write a program to transfer files over "https" using "GET" & "POST", but I do not know where to start from, like which java packages to use, sample programs etc.
Any pointers would be most helpful.
Thanks a lot in advance.

You're wanting to write a servlet. The package for servlets is javax.servlet and javax.servlet.http. There is no difference in accessing a servlet with https.
You can find a good reference implementation of the servlet code on Apache's Tomcat.

Taking in many concurrent requests via a single servlet

Hi,
My objective for this topic is to find a way to make my tomcat app able to handle as many as possible concurrent requests.
My app spec is
-servlet running on Tomcat 5.0
My app is a mobile text messaging app that receives requests via a single servlet, called InboundRequest. This servlet will,
1. Read the HTTP params in the request
2. Decide to which other servlet classes it should forward to (RequestDispatcher)
3. The recipient servlet will read the HTTP param, process it and outputs the data via OutboundResponse java class.
So, my issue is,
1. What factor decides the number of concurrent requests my InboundRequest servlet can handle? Is it my code or Tomcat itself or the server hardware
2. Since I'm using Request Dispatcher forwarding, if say i have a request that takes 5 seconds to complete the its task (to output the result via OutboundResponse), will in inhibits/stops any other requests that comes in during that 5 seconds?
I appreciate all expertise i can get.
Regards,
Mel.

There is nothing to worry about that concurrent request handling as container will create one instance of your servlet and then for each client request it will spwan a single thread which will handel the client request.If u r implementing SingleThreadModel then onle one thread will be spwan and it will handle the requests one by one .So it will be slower .

System shud restrict stock posting of 04 inspection lot

Dear ALL,
Pain Area - whenevr Process order get release 03 inporcess inspection lot generates and after Process order get confrimed
O4 inspection lot generates , Evry time we use to process 04 Inpsection lot and then stock posted from Quality to Unrestrcted and finally , urestricted stock goes to market . NOw 03 inpsection lot remains in Created status , system not restriced for 04 activity i.e stock posting . So I want to restrict stock posting of 04 inspection lot if 03 inpsection lot doesnt have UD status .
please suggest .
Regards,
Prerna Verma

Do you want to put a hard error when UD is taken for O4 lots, if the corresponsding SF lot is not released? This will stop users releasing the 04 lots and personally I am not in favor of writing a piece of code in User exit at UD and stiop the release of a Finished Batch.
I have worked on similar requirement where users used to check manually the SF batch - UD prior to release a Finished Lot. to reduce the manual work and data transpose errors, we have used a calculated char. SF batch released? and assigned it in the finished product inspection paln.
We copied the standard FM - QEFC_FORMULA_CALC_EXAMPLE and written a logic to look the consumed SF batch is released or not .The Function Module is assigned to a Calculated Characteristic u2013 the user will then be able to Calculate the characteristic during Results Recording of a batch of Finished Product to determine the Release Status of the issued batch of Semi-Finished material, as opposed to having to look it up manually. We looked at the Q-score to decide a SF batch is released , rejected or UD not taken. The Function Module used the name of the Master Inspection Characteristic (MIC) and the Material Type of the Inspection Lot to determine the Inspection Lot Q-Score to return.
With this set up you will not issue a hard error at the time of UD for Finsihed batch at the same time users will know the SF batch status when the results were recorded for Finished batch.
If your requirement is a Hard error, simply go for the user exit suggested and write a logic to look for the Semi Finished Batch consumed.
Hope it helps.
Thanks,
Ram

Obtaining custom HTTP GET / POST parameters of variable length in Application Process

Hi, I'm trying to connect a javascript UI control within my page to an APEX Application Process.
The control calls the application process via AJAX and appends a variable number of GET / POST parameters to its URL.
What is the best way to obtain these parameters from within the PLSQL procedure of the process? Or is there a better way to connect my javascript AJAX control to the Database behind my APEX app?
Thanks,
Steffi

Steffi,
I'm using APEX 4.1 and I've not used Treegrid before. It does look pretty interesting.
Firstly, I'm not sure if you are aware but GET requests aren't as secure as POST requests. GET simply appends a key/value pair to the server as part of the url which can be easily sniffed. POST request on the other hand sends the data as key/value pairs to the server in the header which makes it harder to intercept. This is why APEX outputs forms with POST methods.
Secondly, back to your original question.I'm not sure this is possible with an Application Process. In the passed I've used POST methods to pass values to my Application Process. I have some code using native jQuery if you would like to see how its done. Alternatively, if you convert your application process to a standard pl/sql procedure (i.e SQL Workshop>Object Browser>Procedures) you can call this procedure and pass in values as you would with any PHP page.
Simple example (untested)
CREATE OR REPLACE PROCEDURE "foo" ( my_name varchar(20)
     , count NUMBER)
IS
     p_name varchar(20) := my_name;
     p_count NUMBER     := count;
BEGIN
--Do what you want
--output something
   htp.p(p_count || '.: '|| p_name);
END;
The url on the page (or ajax call) would be something like "/pls/apex/{MY SCHEMA}.foo?my_name=Alistair&count=1"
Of course for text you will need to escape single colons and special characters etc.
I would really like to help you further so if you could create a working demo using a free workspace on http://www.apex.oracle.com and provide me with demo username/password. I can try and have a better look for you.
In all honesty, I'm sure you would be looking to create this as a plugin so that you can easily reuse it in various parts of your application and can easily update it or maintain it. I can help you with that as well if you want.
Alistair
P.S You might want to update your profile on this forum to provide your name so people dont just see "31742965-2d09-4f42-849f-e39eb2cfbc9e" your profile name

Multi Servelt Vs Single Servlet Pattern

Hi,
Can somebody throw some light on where and when to go for a multiple servlet pattern and when to opt for a single servlet solution.
As for example, I have to develop an application for Customer rating. So, I have two modules one Customer and other Rating. These two will be sending requests to the web-server. I want to use Servlets for handing those requests. I wanted to know whether I should keep seperate servlets (CustomerServlet & RatingServlet) for each module and chain them up for common processing or should I use a single servlet(AppServlet) handling all the requests from all modules.
I would appreciate if I can get any reference to the reading material available on internet on this.

Hi Rakesh,
what u can do is Use a single servlet(AppServlet) handling all the requests from all modules. Keep your Security Module separate if u want to have all your WebPages check USer Session.
cheers,
Sachin

GET & POST

Hi, When we develop Servlets for Forms on web pages, we use doPost most of the time, and if I am not mistaken, the implementation between doPost and doGet are basically the same on the Servlet side. Can someone tell me what the difference is on the HTML side between Get & Post? And what makes us favour doPost over doGet most of the time?
Many Thanks.

The only time you need to use POST is when you're submitting more than 4,096 bytes of data. That's the limit on the amount of data you can send with a GET request. Using POST for all form submissions will work well for you.
There's only one case that I can think of where it's preferable to use a GET request. Say you have a form that uses a POST request. After posting the request, the user ends up going to a page with a bunch of links on it and clicks one of them. Then, they decide they want to go back to the form they posted. When they do that with their back button though, the browser will intervene and warn that they'll need to resubmit the post data or cancel the request. Now, switch that POST request to a GET request for the form and they'll be able to go back without any problems.

Data is not getting posted in ABAP Proxy.

Hi,
I am working on File to ABAPProxy scenario. The data is not going to proxy.
In PI sxmb_moni is status is successfull and in the R3 sxmb_moni the status is successfull. But the data is not getting posted in the tables(ABAPProxy). I had checked the inbound and oubound queues. And with the same input data, abapers cheked their code in Abapproxy, then the table is getting updated. When we trigger from PI, the tables are not getting updated.Please help me.
Thanks,
Pragathi.

Hi,
The problem may be
Case 1: Cache is not getting refreshed(Check SXI_CACHE)
Case 2: The Queue Is blocked (Check SMQ1 & SMQ2)
Regards,
Sainath

How to get the value from a servlet?

Hello guys:
how can i get the value from a servlet on my jsp page,for example return a boolean variable from a servlet
which API to use?
thanks

Hi
There is no specific API for this, call the method of the servlet which returns the required value in your JSP page.
Thanks
Swaraj

How to get an ArrayList Object in servlet from JSP?

How to get an ArrayList Object in servlet from JSP?
hi all
please give the solution for this without using session and application...
In test1.jsp file
i am setting values for my setter methods using <jsp:usebean> <jsp:setproperty> tags as shown below.
After that i am adding the usebean object to array list, then using request.setAttribute("arraylist object")
---------Code----------
<jsp:useBean id="payment" class="com.common.PaymentHandler" scope="request" />
<jsp:setProperty name="payment" property="strCreditCardNo" param="creditCardNumber" />
<%-- <jsp:setProperty name="payment" property="iCsc" param="securityCode" /> --%>
<jsp:setProperty name="payment" property="strDate" param="expirationDate" />
<jsp:setProperty name="payment" property="strCardType" param="creditCardType" />
<%--<jsp:setProperty name="payment" property="cDeactivate" param="deactivateBox" />
<jsp:setProperty name="payment" property="fAmount" param="depositAmt" />
<jsp:setProperty name="payment" property="fAmount" param="totalAmtDue" /> --%>
<jsp:useBean id="lis" class="java.util.ArrayList" scope="request">
<%
lis.add(payment);
%>
</jsp:useBean>
<%
request.setAttribute("lis1",lis);
%>
-----------Code in JSP-----------------
In testServlet.java
i tried to get the arraylist object in servlet using request.getAttribute
But I unable to get that arrayObject in servlet.....
So if any one help me out in this, it will be very helpfull to me..
Thanks in Advance
Edward

Hi,
Im also facing the similar problen
pls anybody help..
thax in advance....
Litty

Restrict GET/POST to a single servlet

Similar Messages

Maybe you are looking for