How to create ConfirmServlet using a JavaMail / Servlet Mechanism?

[Michael K. Wilson]

Am in the process of writing a server side Java program (servlet) which would send an e-mail to a user with a confirmation URL (located in the body of the e-mail).

Have already created the servlet (which can send an e-mail) using the JavaMail API... Am wondering how I would design / implement the actual unique URL (where upon an end user's click, it launches a browser and states "Confirmed." in a web page)? The confirmed would have to match either the end user's e-mail address (for verification purposes) or an encrypted token correct?

Would appreciate it if someone could point me in the right direction...

So far this is what my SendMailServlet looks like:

public void doPost(HttpServletRequest request,
			HttpServletResponse response) throws ServletException, IOException
	{
		response.setContentType(CONTENT_TYPE);
		PrintWriter out = response.getWriter();
		boolean debug = true;

		String host = "smtp.gmail.com";
		String username = "myuser";
		String password = "";
		String content = "Hello there, " 
			              + "\n\n" 
						  + "Wanna play golf? :-)"  
			              + "\n\n" 
			              + "Please confirm: https://mysite.com/confirm?code=" 
			              + "\n\n"
			              + "-Mike";
		String subject = "Greetings";

		Properties props = new Properties();
		props.put("mail.smtps.auth", "true");
		Session session = Session.getDefaultInstance(props);
		session.setDebug(debug);

		MimeMessage msg = new MimeMessage(session);
		// set the message content here
		try
		{
			Logger.getLogger(this.getClass())
					.warn("Before grabbing Transport.");
			Transport transport = session.getTransport("smtps");
			try
			{
				msg.setContent(content, "text/plain");
				transport.connect(host, username, password);
				Logger.getLogger(this.getClass()).warn(
						"Before send message invocation.");
				msg.setSubject(subject);
				msg.setRecipients(Message.RecipientType.TO, "[e-mail]");
				transport.sendMessage(msg, msg.getAllRecipients());
				Logger.getLogger(this.getClass()).warn(
						"Message sent");
				out.println("Message Sent");
				
			}
			catch (Throwable t)
			{
				System.out.println("Unable to send message.");
				t.printStackTrace();
			}
		}
		catch (NoSuchProviderException e)
		{
			e.printStackTrace();
		}
	}

If you notice in the e-mail's content, I have it set like this:

"Please confirm: https://mysite.com/confirm?code=" 

(1) So, basically, should I run a TokenGenerator for the code and then create a ConfirmServlet which would perform a doGet() method with confirm code's parameters?

(2) Would I need to generate a token which would match with the User created in a database or would I use HttpSessions or Cookies appended to the URL?

(3) Is this better to use inside a ServletFilter rather than a Servlet?

Happy programming,

Mike

[Nishan Patel]

Hi Michael,

As you know when you are deal with web application you have to create two type of url.

1) Url which is required mandatory authentication.
2) URL Not required authentication.

Do just one thing first time when user registered with your application generate 10 digit random number which contains [a-z,A-Z,0-9] and store that number to that user database with respected use.

Now you have already done work for mailing side and send mail that number appending with URL. Then generate url which contains action which is not required authentication when user hit that url you get request on your server. Now get that number using query string and select user which have that reference number.

Now you just put one filed at your user table which contains user status. At first time it contains false value after clicking your URL just update that status record of that url. Now you validate your user using your mail...

[Michael K. Wilson]

Nishan,

Thanks for the help! I have a TokenGenerator in place...

So, you are saying generate the Token inside the SendMailServlet (and save to database) and then append it like this:

String generatedURL = "http://locahost:8080/myapp/confirm?token=" + token.getToken().toString();

I know how to get and set the token to the database. What am I seeking is the mechanism in the ConfirmServlet.

How would the code point to the ConfirmServlet (and how would I make it so the ConfirmServlet would launch when this URL was clicked)?

Should I use a ServletFilter instead of Servlet?

And would this be done as an Http doGet() response / request?

Any code samples would be very helpful...

-Mike

[Nishan Patel]

Hi Michael,

you are always welcome ..

So, you are saying generate the Token inside the SendMailServlet (and save to database) and then append it like this:

yes, generate the Token not inside SendMailServlet , but when user registers generate token and store into database.

And that Token send in mail with Url as you say.

    String generatedURL = "http://locahost:8080/myapp/confirm?token=" + token.getToken().toString();     

.

Should I use a ServletFilter instead of Servlet?

there is no need to use ServletFilter. you can achieve only using Servlet.

Do one thing map confirm action at your web.xml and select your ConfirmServlet. Now you get Token with requested url. get that token into servlet and select user from database which contains that Token get from URL. So now make user active field true or active.

That's way you can get it...

[Michael K. Wilson]

Thank you so much Nishan!

How would I map the Confirm servlet with:

http://locahost:8080/myapp/confirm?token= ?

You mean set up the web.xml (deployment descriptor) like this:

<servlet>
    <servlet-name>ConfirmServlet</servlet-name>
    <servlet-class>com.myapp.mail.ConfirmServlet</servlet-class>
  </servlet>
  
  <servlet-mapping>
  	<servlet-name>ConfirmServlet</servlet-name>
  	<url-pattern>/confirm/</url-pattern>
  </servlet-mapping>

So, far, this is what I have for the ConfirmServlet:

public class ConfirmServlet extends HttpServlet
{
	public void doGet(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {
		doPost(request, response);
	}
	
	public void doPost(HttpServletRequest request, HttpServletResponse response) 
        throws ServletException, IOException {
		User user = new User();
		Token token = new Token();
		user.setConfirmed(false);
		
		token.setMailToken(mailToken);  
		System.out.println(mailToken);
	}
}

How do I include processing inside the ConfirmServlet for the confirm parameter?

Is there a way to do this by using a WebService (REST) or should I stick with servlet?

Thank you so much for your help,

Mike

[Nishan Patel]

Hi,

your mapping is true. just remove "/" from <url-pattern>/confirm/</url-pattern> to <url-pattern>/confirm</url-pattern> .

But make it something different.

When user registered call one servlet RegiServlet.

At that time in this servlet store all information of your user with new token of that user and set user Confirmed status false as you set at Confirmed servlet above.

user.setConfirmed(false);

Now send mail to user with Url

http://locahost:8080/myapp/confirm?token= Your token value

.

When your click on this link now your ConfirmServlet comes into the picture.

In this servlet you get token. With this token get user from database and simply make this user Confirm with with true.

user.setConfirmed(true);

That way you make it...

[Michael K. Wilson]

Dear Nishan,

Thank you very much for all of your help...

Questions:

1. Why do I need RegiServlet? Why can't I set just the user.setConfirmed(false); inside my SendMailServlet?

2. What does the code look like in the doPost() or doGet() methods of the ConfirmServlet?

That's what I am confused about...

3. How can I send the confirm parameter (located in the URI) to my ConfirmServlet?

4. Will I need to set session attribute to user in SendMailServlet or RegiServlet and then get the session attribute from the ConfirmServlet?

Would really help if you could assist me with how the ConfirmServlet grabs the token parameter (once the user clicks on the e-mail) and processes it inside doGet() or doPost()?

Thank you for all of your help - its most appreciated!

-Mike

[Nishan Patel]

Hi,

1. Why do I need RegiServlet? Why can't I set just the user.setConfirmed(false); inside my SendMailServlet?

I just say RegiServlet servlet because I think you have application when user registered your application. After registered you just send your mail to user. No matter it's RegiServlet or SendMailServlet. But more appropriate name was RegiServlet and in that servlet you make a code to send mail. But at last choice is yours .

2. What does the code look like in the doPost() or doGet() methods of the ConfirmServlet?

As I said at the time of registration you have generate one token which store to database and that code append with your link which is send to user in Mail. So when user click on link you get that code with query string. Now get that code and just make select query like SELECT * FROM User where activationKey = "your query string key".. like that.

Now you get user just set that user Confirmed filed true. like user.setConfirmed(true); ..

3. How can I send the confirm parameter (located in the URI) to my ConfirmServlet?

you don't have to send any confirm parameter to ConfirmServlet. That parameter already send you by mail with append at url. when user click on link you your ConfirmServlet get that token in query string. so you just send it to append with query string in Mail.

4. Will I need to set session attribute to user in SendMailServlet or RegiServlet and then get the session attribute from the ConfirmServlet?

No. I don't think so. Before user Confirmation you user not active our application. So session will not activated before user Confirmed.
when user Confirmed, after that you provide to user login page and after enter username and password he or she can login and then activate session.

[Michael K. Wilson]

Nishan,

Thank you very much for the help... Am not using JDBC / SQL, I am using Hibernate / JPA, so here's what I've come up with:

public class SendMailServlet extends HttpServlet
{
	private static final String CONTENT_TYPE = "text/html";

	public void doPost(HttpServletRequest request, 
	                   HttpServletResponse response) 
	throws ServletException, IOException
	{
		response.setContentType(CONTENT_TYPE);
		PrintWriter out = response.getWriter();
		boolean debug = true;
		
		String mailToken = TokenUtil.getEncryptedKey();

		String host = "smtp.gmail.com";
		String username = "user";
		String password = "password";
		String content = "Hello there, " 
			              + "\n\n" 
						  + "Please click on the below link to
						      activate / confirm your account."  
			              + "\n\n" 
			              + "Please confirm: https://localhost:8443/confirm?token=" + mailToken 
			              + "\n\n"
			              + "Thank you...";
		String subject = "Please Confirm Account";

		Properties props = new Properties();
		props.put("mail.smtps.auth", "true");
		Session session = Session.getDefaultInstance(props);
		session.setDebug(debug);

		MimeMessage msg = new MimeMessage(session);
		// set the message content here
		try
		{
			Logger.getLogger(this.getClass())
					.warn("Before grabbing Transport.");
			Transport transport = session.getTransport("smtps");
			try
			{
				msg.setContent(content, "text/plain");
				transport.connect(host, username, password);
				Logger.getLogger(this.getClass()).warn(
						"Before send message invocation.");
				msg.setSubject(subject);
				msg.setRecipients(Message.RecipientType.TO, "[e-mail]");
				transport.sendMessage(msg, msg.getAllRecipients());
				Logger.getLogger(this.getClass()).warn(
						"Message sent");
				out.println("Message Sent");
				
			}
			catch (Throwable t)
			{
				System.out.println("Unable to send message.");
				t.printStackTrace();
			}
		}
		catch (NoSuchProviderException e)
		{
			e.printStackTrace();
		}
	}

	public void doGet(HttpServletRequest request, HttpServletResponse response)
			throws IOException, ServletException
	{
		doPost(request, response);
	}
}

web.xml (deployment descriptor):

<servlet>
  <servlet-name>ConfirmServlet</servlet-name>
  <servlet-class>com.myapp.ConfirmServlet</servlet-class>
</servlet>

<servlet-mapping>
	<servlet-name>ConfirmServlet</servlet-name>
	<url-pattern>/confirm</url-pattern>
</servlet-mapping>

My Confirm and User classes are Annotated JPAs (with the Confirm holding a Foreign Key with User - OneToOne Mapping):

User:

@Entity
@Table(name = "user", schema = "mydb")
public class User {

	private int id;	
	private Boolean confirmed;
	private Confirm confirm;

	@Id
	@GeneratedValue(strategy = IDENTITY)
	@Column(name = "id", unique = true, nullable = false)
	public Integer getId() {
		return this.id;
	}

	public void setUserid(Integer id) {
		this.id = id;
	}

	public void setId(int id) {
		this.userid = userid;
	}
	
	@OneToOne(cascade = CascadeType.ALL, mappedBy = "user")
	public Confirm getConfirm() {
		return confirm;
	}

	public void setConfirm(Confirm confirm) {
		this.confirm = confirm;
	}
	
	// isConfirmed() method and setConfirmed() methods
}

Confirm:

@Entity
@Table(name="confirm", schema="mydb")
public class Confirm {

	private int id;
	private String mailToken;	
	private User user;

	@Id
	@GeneratedValue(strategy = IDENTITY)
	@Column(name = "id", unique = true, nullable = false)
	public int getId() {
		return id;
	}

	public void setId(int id) {
		this.id = id;
	}

	@Column(name = "mailToken")
	public String getMailToken() {
		return mailToken;
	}

	public void setMailToken(String mailToken) {
		this.mailToken = mailToken;
	}
	
	@OneToOne(cascade = CascadeType.ALL, fetch = FetchType.LAZY)
	@JoinColumn(name = "user_id")
	public User getUser() {
		return user;
	}

	public void setUser(User user) {
		this.user = user;
	}
}

My ConfirmServlet:

public class ConfirmServlet extends HttpServlet {
	public void doGet(HttpServletRequest request, HttpServletResponse response) {
		response.setContentType("text/html"); 
		String key = "token";
		String mailToken = request.getParameter(key);
		User user = new User();
		user.setUsername("John Doe");
		user.setPassword("pizza");
		user.setEmailAddress("[e-mail]");
		user.setConfirmed(false);

		Confirm confirm = new Confirm();
		confirm.setUser(user);
		confirm.setMailToken(mailToken);
		user.setConfirm(confirm);
                user.setConfirmed(true);
		System.out.println("Mail Token: " + mailToken);
		
		// Print confirmed to screen	
		// Save Hibernate Session
	}
	
	public void doPost(HttpServletRequest request, HttpServletResponse response) {
		doGet(request, response);
	}

}

Now, when I run the server and send the e-mail and click on the embedded confirmation URL with the token, this is
what happens:

HTTP Status 404 - /confirm
type Status report
message /confirm
description The requested resource (/confirm) is not available.

Questions:

- How come it doesn't run the ConfirmServlet's doGet() method or how come ConfirmServlet isn't recognized?

- How do I make the ConfirmServlet know who the user is? As you can see I am instantiating the User instance manually...

- I need to have it so it can also handle from multiple receipients...

Happy programming,

Mike

[Nishan Patel]

Hi Michael Nice to see you again..

You just do one thing your SendMailServlet was perfect. just you need to change your User table and Confirm table.

Now just make one thing change user table and store all user information to one User table. so no need to make Confirm table.

I give you reason why.

Think application point of view. When you reach at login you have to registered session. Now at that time select user object and store that object to session.
So at any time of your application your user object available to you and for developer it is easy to get user any data without making database trip.

so make user table like.

  private int id;
private String userName;
private String password;
private String email;
private Boolean confirmed;
private String mailToken;

[b]Other user variable;[/b]    

My ConfirmServlet:

view plaincopy to clipboardprint?

1. public class ConfirmServlet extends HttpServlet {
2. public void doGet(HttpServletRequest request, HttpServletResponse response) {
3. response.setContentType("text/html");
4. String key = "token";
5. String mailToken = request.getParameter(key);
6. User user = new User();
7. user.setUsername("John Doe");
8. user.setPassword("pizza");
9. user.setEmailAddress("[e-mail]");
10. user.setConfirmed(false);
11.
12. Confirm confirm = new Confirm();
13. confirm.setUser(user);
14. confirm.setMailToken(mailToken);
15. user.setConfirm(confirm);
16. user.setConfirmed(true);
17. System.out.println("Mail Token: " + mailToken);
18.
19. // Print confirmed to screen
20. // Save Hibernate Session
21. }
22.
23. public void doPost(HttpServletRequest request, HttpServletResponse response) {
24. doGet(request, response);
25. }
26.
27. }

your confirm servlet change. this is not right place to set other user information. you have to make it in sendMailServlet. in ConfirmServlet you just have to change user.setConfirmed(false); to user.setConfirmed(true);

Mail always send after user make complete registration.

[Michael K. Wilson]

Nishan,

Thank you for your advice but how come I am unable to view my Confirm servlet when I clicked on the embedded URL?

HTTP Status 404 - /confirm
type Status report
message /confirm
description The requested resource (/confirm) is not available.

I'll try again... Also, how do I process the token or user inside my ConfirmServlet's doGet() method?

Right now its not able to view the servlet and thus I can't proceed...

Why am I getting the 404 error?

Happy programming,

Mike

[Nishan Patel]

Hi,

very simple mistake was here

https://localhost:8443/confirm?token=" + mailToken

it looks like https://localhost:8443/Your application Name/confirm?token=" + mailToken.

so like if your application name like sampleApplication then it look like

https://localhost:8443/sampleApplication /confirm?token=" + mailToken .

now i think you will get your answer.

[Michael K. Wilson]

Nishan,

Okay, I changed that (by adding myapp inside the URL)...

Now, when I click on the link, it does redirect to:

https://localhost:8443/myapp/confirm?token=5YwRpWRyIGv8KW4IMCBf9PUcMj8TEt3DUv++ONHV1mI=

But nothing happens in the database...

-Mike

[Nishan Patel]

Yes,

That's what i want to say, you first make user registration at your send mail servlet and at that time you have to generate that key which store your user table.

Now when user click on your url you get that key which is unique. Now just select user which contains that key.... So, first store token into user table and then select user with that token. Now just update confirm field for that user and update user table with new data.

[Michael K. Wilson]

Where do I put that inside the Confirm Servlet or even the SendMail servlet?

Can you please display some sample code? How does the ConfirmServlet or MailServlet know where to get the user object reference from SendMailServlet and set its confirmed to true?

Thank you for all of your help!

-Mike

[Michael K. Wilson]

Nishan,

Good news! When I click on the embedded URL, my ConfirmServlet does run...

public class ConfirmServlet extends HttpServlet {

	public void doGet(HttpServletRequest request, HttpServletResponse response) {
		Logger.getLogger(this.getClass()).warn("Inside Confirm Servlet");
		response.setContentType("text/html");
		String mailToken = "token";
		String key = request.getParameter(mailToken);	
		Logger.getLogger(this.getClass()).warn("Mail Token received: " + key);
   }
}

My local server's console (after I click on the e-mail's confirm embedded URL):


WARN ConfirmServlet:25 - Inside Confirm Servlet
WARN ConfirmServlet:31 - Mail Token received: yfPRA00LiNHhB6QYuXByq4E78dUp8zOLryAb68ZfBnI=


In the servlet which sends the e-mail, I hard coded the user's e-mail address for test purposes...

Will be pulling the e-mail address out of a Hibernate 3 / JPA object in my real code...

Question(s):

(1) How do I set my User class's setConfirmed(true)?

(2) Meaning, how do I send the user object reference to ConfirmServlet?

The user will be instantiated as part of the HibernateSession in the servlet which sends my e-mail...

(3) Should I use URL encoding / decoding?

Now when user click on your url you get that key which is unique. Now just select user which contains that key.... So, first store token into user table and then select user with that token. Now just update confirm field for that user and update user table with new data.

This last part of selecting having ConfirmServlet know which user it was confirmed by is confusing...

In the servlet which sends the e-mail, I hard coded the user's e-mail address for test purposes...

Will be pulling the e-mail address out of a Hibernate 3 / JPA object in my real Send Mail servlet code...

See, I don't understand how the ConfirmServlet would know of my User object reference...

I am using Hibernate / JPA 3 so could you show me some sample code on how to do this?

Happy programming and many, many thanks for writing me back!

-Michael