web.xml

[hemant thakare]

Hey folks...

Does anybody have a handy guide to the different elements and their significance in web.xml ?

Thanks,
Hemant.

[Cai DongShan]

Hemant,

The following is my web.xml.

  <web-app xmlns="http://java.sun.com/xml/ns/j2ee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
version="2.4">
 
<servlet>
<servlet-name>servlettest</servlet-name>
<servlet-class>foo.ServletTes</servlet-class>
<init-param>
<param-name></param-name>
<param-value></param-vale>
</init-param>
</servlet>
 
<servlet>
<servlet-name>servlet1</servlet-name>
<servlet-class>foo.ServletTest1</servlet-class>
<load-on-startup>2</load-on-startup>* any non-negative value
</servlet>
 
<servlet>
<servlet-name>servlet2</servlet-name>
<servlet-class>foo.ServletTest2</servlet-class>
<load-on-startup>1</load-on-startup>* will be loaded before servlet1 (2)
</servlet>
* servlet mapping sequence: 
exact match, 
directory match, 
extention match
<servlet-mapping>
<servlet-name>servlettest</servlet-name>
<url-pattern>/servlettest.do</url-pattern>* exact match, begin with /
</servlet-mapping>
 
<servlet-mapping>
<servlet-name>servlet1</servlet-name>
<url-pattern>/Beer/*</servlet-name>* for directory match, begin with / and end with /*
</servlet-mapping>
 
<servlet-mapping>
<servlet-name>servlet2</servlet-name>
<url-pattern>*.do</servlet-name>* for extention match, begin with *.
</servlet-mapping>

<servlet>
<servlet-name>jsptest</servlet-name>
<jsp-file>/jsptest.jsp</jsp-file>
 
<init-param>
<param-name></param-name>
<param-value></param-value>
</init-param>
</servlet>
 
<servlet-mapping>
<servlet-name>jsptest</servlet-name>
<url-pattern>/jsptest.jsp</url-pattern>
</servlet-mapping>

<context-param>
<param-name></param-name>
<param-value></param-value>
</context-param>
 
<listener>
<listener-class></listener-class>
</listener>
 
<session-config>
<session-timeout></session-timeout>
</session-config>
 
<jsp-config>
<jsp-property-group>
<url-pattern>*.jsp</url-pattern>
<scripting-invalid>true</scripting-invalid>* it can only be set here
</jsp-property-group>
<jsp-property-group>
<url-pattern>*.jsp</url-pattern>
<el-ignored>true</el-ignored>
</jsp-property-group>
 
<taglib>* It is not required in JSP 2.0
<taglib-uri>randomThings</taglib-uri>
<taglib-location>/WEB-INF/myFunctions.tld</taglib-location>
</taglib>
</jsp-config>
 
<servlet-mapping>
<servlet-name>.jsp</servlet-name>
<url-pattern>.jspf</url-pattern>
</servlet-mapping>
* can't use exception-type and error-code together
<error-page>
<exception-type>java.lang.Throwable</exception-type>* must be fully-qualified class name
<location>/errorPage.jsp</location>* must start with /
</error-page>* error can be generated by response.sendError()
 
<error-page>* 
<exception-type>java.lang.ArithmeticException</exception-type>
<location>/arithmeticError.jsp</location>
</error-page>

<error-page>
<error-code>404</error-code>
<location>/notfounderror.jsp</location>* must start with /
<error-page>
 
<welcome-file-list>* If there is not servlet maping match, goes here
<welcome-file>index.html</welcome-file>* must not start or end with a slash "/"
<welcome-file>default.jsp</welcome-file>
</welcome-file-list>
 
<ejb-local-ref>* client and the bean must be running in same JVM
<ejb-ref-name>ejb/Customer</ejb-ref-name>* JNDI lookup name
<ejb-ref-type>Entity</ejb-ref-type>
<local-home>com.smart.CustomerHome</local-home>* fully-qualified names of the bean's 
  exposed interface
<local>com.smart.Customer</local>
</ejb-local-ref>
 
<ejb-ref>* client and bean can be running in different JVMs
<ejb-ref-name>ejb/LocalCustomer</ejb-ref-name>
<ejb-ref-type>Entity</ejb-ref-type>
<home>com.smart.CustomerHome</home>
<remote>com.smart.Customer</remote>
<ejb-ref>
 
<env-entry>
<env-entry-name>rates/discountRate</env-entry-name>
<env-entry-type>java.lang.Integer</env-entry-type>* must not be a primitive
<env-entry-value>10</env-entry-value>
<env-entry>
 
<mime-mapping>
<extension>mpg</extension>* without dot "."
<mime-type>video/mpeg</mime-type>
</mime-mapping>
 

<login-config>
<auth-method>BASIC</auth-method>* HTTP, Base64 - weak
</login-config>
 
<login-config>
<auth-method>DIGEST</auth-method>* HTTP, Stronger - but not SSL
</login-config>
 
<login-config>
<auth-method>CLIENT-CERT</auth-method>* J2EE, Strong - public key, (PKC)
</login-config>
 
<login-config>
<auth-method>FORM</auth-method>* J2EE, Very weak, no encryption
 
<form-login-config>
<form-login-page>/loginPage.html</form-login-page>
<form-error-page>/loginError.html</form-error-page>
</form-login-config>
</login-config>
* <form method="POST" action="j_security_check">
<input type="text" name="j_username">
<input type="password" name="j_password">
<input type="submit" value="Enter">
  </form>


<security-role>
<role-name>Admin</role-name>
<role-name>Member</role-name>
<role-name>Guest</role-name>
<security-role>
 
<security-constraint>* If more than one <security-constraint>
  all of the role names listed will be allowed
  but <auth-constraint/> is final
<web-resource-collection>* can have more than one in
         <security-constraint>
<web-resource-name>UpdateRecipes</web-resource-name>* mandatory name, used by tool
 
<url-pattern>/Beer/Addrecipe/*</url-pattern>* at lease one
<url-pattern>/Beer/ReviewRecipe/*</url-pattern>
 
<http-method>GET</http-method>* optional, only the HTTP method list will be constrainted
<http-method>POST</http-method>* If there are not <http-method>, all are allowed
* valid methods are GET, POST, PUT, TRACE, DELETE
  HEAD and OPTIONS
</web-resource-collection>
 
<auth-constraint>* optional
  If exist, must perform authentication for the URLs
  If not exist, allow unauthenticated access for the URLs
<role-name>Admin</role-name>* If no <role-name> element, then no users are allowed
<role-name>Member</role-name>* role names are case-sensitive

<role-name>*</role-name>* All users are allowed
</auth-constraint>
 
<auth-constraint/>* nobody can access
 
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>* NONE (default)
  CONFIDENTIAL
  INTEGRAL
</user-data-constraint>

</security-constraint>

<servlet>
<securite-role-ref>* this will be looked first for isUserInRole()
<role-name>Manager</role-name>* request.isUserInRole("Manager")
<role-link>Admin</role-link>
</securite-role-ref>
...
</servlet>

<filter>
<filter-name>BeerRequest</filter-name>
<filter-class>chapter13.BeerRequestFilter</filter-class>
 
<init-param>* optional
<param-name>LogFileName</param-name>
<param-value>UserLog.txt</param-value>
</init-param>
</filter>
 
<filter-mapping>
<filter-name>BeerRequest</filter-name>
<url-pattern>*.do</url-pattern>* match URL pattern first, and then servlet name
* optional, can have 0 to 4 dispatcher
<dispatcher>REQUEST</dispatcher>* REQUEST is default if there is not dispatcher
<dispatcher>INCLUDE</dispatcher>
<dispatcher>FORWARD</dispatcher>
<dispatcher>ERROR</dispatcher>

</filter-mapping>
 
<filter-mapping>
<filter-name>BeerRequest</filter-name>
<servlet-name>AdviceServlet</servlet-name>
</filter-mapping>

</web-app>  

[Christophe Verré]

You can refer to the servlets specification which has a nice diagram.

[hemant thakare]

Thank you guys...

[Shivani Chandna]

* If there are not <http-method>, all are allowed

Incorrect. Then all http-method's are constrained.

[Cai DongShan]

Shivani,

Thanks for pointing out my error. In Servlet 2.4 spec P133,

If no HTTP methods are specified, then the security constraint applies to all HTTP methods

The messages in HFSJ P634 & P635 & errata confuse us.

[Christophe Verré]

That's why I never refer to other people's material