Brice Giesbrecht

Our organization also has the same concern about our JBoss App Server. When they perform a scan, they see several http methods are listed in the Allow header that they don't like.

HTTP/1.1 405 Method Not Allowed Server: Apache-Coyote/1.1 Allow: POST, GET, DELETE, OPTIONS, PUT, HEAD

Our application does not use most of these and we have restricted access using a security-constraint section in our web.xml. The problem is, the Allow header is not being generated based on the contents of the web.xml.

Tomcat uses reflection to determine which methods are present in the servlet and builds the Allow header from that (this is getServletMethods in the org.apache.catalina.core.StandardWrapper class).

The question is, which servlet does it query? Well, it depends on which resource is being queried. In my case, the scan just hits the root of the server. If you are checking the root of the server (i.e. TRACE / HTTP/1.0) you are most likely hitting the default servlet which is defined in conf/web.xml in your Tomcat install.

<servlet> <servlet-name>default</servlet-name> <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>

To change the output, one option is to use another servlet as the default servlet. Since we do not really use the default servlet, I just wrote another servlet which does not use these methods.

<servlet> <servlet-name>default</servlet-name> <servlet-class>com.foo.VerySimpleServlet</servlet-class>

This servlet extends GenericServlet and just has a doGet and a doPost for the http methods. Now when we do a scan, all we see is this:
HTTP/1.1 405 Method Not Allowed Server: Apache-Coyote/1.1 Allow: GET, HEAD, POST

If you want to keep the default servlet, or you need to do this for more than just the root, then using a valve is probably the best thing. If you don't need the default servlet, then this is a pretty quick and easy fix.

Using the static initializer does actually cause synchronization but it is implicit and done by the jvm during the class loading and initialization routine. So, you could say I sort of cheated by suggesting that.

To guarantee that only one process is executing in the critical section of your method that will be doing the actual initialization (like getInstance), somewhere down the line you will need to use synchronization explicitly (or implicitly like the static init). You can bury it using many layers but it will be there.

I am curious about the aversion to using synchronization. Can you provide a little info on that?

To make your singleton, you can use a static initializer in your singleton.

public class SingletonExample { private static SingletonExample me = null; static { me = new SingletonExample(); } public static SingletonExample getInstance() { return me; } private SingletonExample() {} }

To use it safely, you still have to make sure that the class remains threadsafe once you start adding functionality.

Hi Akram. It really depends on what you have right now and what you need to do. (Where are you, and where are you going?)

Is your data already i18n in Oracle? Are you using n-types and a unicode (utf-8 or utf-16) character set? Do your i18n requirements include the actual data in Oracle or just the display mechanism?

Struts does have nice i18n support but it is not your only option. Most of the i18n in MVC frameworks have the same set of tasks, they just may vary a bit on how they do it. Resource bundles, tag libs, proper contentType encoding, etc. can be used outside of established MVCs but ymmv.

Here is a link that may help your creative/problem-solving juices start to flow: http://rizafar.blogspot.com/2007/07/internationalization-spring-upon-it.html

-Brice