Paul Ramsden

Imagine the folowing path:

/rest/customer/{custno}/machine/{machineno}/status

I would like to secure the path by testing that the current user has the customer attribute 'custno' and that this customer owns the machine 'machineno'. I expect to be implements role-based security but what I have just described goes much beyond that.

I have tried making annotations which I can add to paths such as:

(a)Security.hasAllOf(HasCustomer, HasMachine)

This has done what I wanted up til now but as I am now trying to make use of Swagger, this is no longer an option as Swagger can't handle it.

What are best practices / typical solutions for this scenario?

One of the hurdles for me when considering developing for HTML5 and JavaScript is the development process. Up til now I have only used JS to add a bit of comfort to the UI in my web applications. All the hard work was done on the server in Java and using all the debugging & logging tools that are pretty much standard.

It is obviously possible to develop useful apps in JS. What tools can be recommended to ensure productivity & quality?

Paul

I have not yet written any HTML5 but I have many many years experience (not all happy) of working with the previous versions. My understanding is that the current browser support is still quite patchy. In my organisation we still have users on XP and IE6!

If I were to create a new site using HTML5, how much of my time would be spend handling all the differences between browsers?
How could I let the page degrade gracefully when some features are not available?
Does your book also handle these issues.

Paul

I am trying to solve a problem where 2 different web pages have signed applets which seem to be causing problems for each other. The first page contains an applet which spawns a new browser window and sets the URL to the second page. Something like this...

cmd /c start iexplore.exe page2.html

Some tracing infomation suggests that the two applets are sharing the same heap and this might be causing the problems.

Is there any way to ensure a complete separation?

I have an applet which is used on a number of pages in my web site. It requires excute priveleges and is signed with a certificate. There are around 1500 users who use the site reqularly and a handful (including myself) have this problem. I'm sure sure but I think it might only occur with users who automatically start more than one page containing a signed applet. For example, my browser starts 2 pages from the web site where this applet is active. The problem does not always occur and when it does then the page just needs to be reopened.

Here is the console dump from today. One page loaded successfully, the other didn't. The lines begining with '[PortalLauncher]' are stdout messages from my applet.

.... security: Keine Zeitstempelinformationen verfügbar security: Zuständigkeitslistendatei gefunden security: Beginn der Überprüfung auf vertrauenswürdige Erweiterung für dieses Zertifikat security: Beginn des Vergleichs der Zuständigkeitsliste mit diesem Zertifikat security: CRL-Unterstützung ist deaktiviert. security: OCSP-Unterstützung ist deaktiviert. security: Diese End Entity-Überprüfung mit OCSP ist deaktiviert. security: Prüfen, ob Zertifikat im Zertifikatsspeicher Deployment denied ist security: Zertifikat wird im permanenten Bereitstellungszertifikatspeicher gesucht security: Zertifikate werden aus Bereitstellungssitzungs-Zertifikatspeicher geladen security: Zertifikate wurden aus Bereitstellungssitzungs-Zertifikatspeicher geladen ***** Checking if certificate is in Deployment permanent certificate store security: Zertifikate werden aus Internet Explorer TrustedPublisher-Zertifikatspeicher geladen ***** Loading certificates from Deployment session certificate store security: Zertifikate wurden aus Internet Explorer TrustedPublisher-Zertifikatspeicher geladen security: Zertifikatskette mithilfe von CertPath-API prüfen security: Zertifikatssammlung aus ZA-Stamm-Zertifikatsspeicher abrufen security: Zertifikatssammlung aus ZA-Stamm-Zertifikatsspeicher abrufen security: Keine Zeitstempelinformationen verfügbar security: Zuständigkeitslistendatei gefunden security: Beginn der Überprüfung auf vertrauenswürdige Erweiterung für dieses Zertifikat security: Beginn des Vergleichs der Zuständigkeitsliste mit diesem Zertifikat security: CRL-Unterstützung ist deaktiviert. security: OCSP-Unterstützung ist deaktiviert. security: Diese End Entity-Überprüfung mit OCSP ist deaktiviert. security: Prüfen, ob Zertifikat im Zertifikatsspeicher Deployment denied ist security: Zertifikat wird im permanenten Bereitstellungszertifikatspeicher gesucht ***** Checking if certificate is in Deployment permanent certificate store [PortalLauncher] Version20111205 [PortalLauncher]Manifest-Version: 1.0 [PortalLauncher]Created-By: 1.6.0_30 (Sun Microsystems Inc.) [PortalLauncher]Display JAR info complete [PortalLauncher]Browser: sun.plugin [PortalLauncher] Version20111205 [PortalLauncher]Manifest-Version: 1.0 [PortalLauncher]Created-By: 1.6.0_30 (Sun Microsystems Inc.) [PortalLauncher]Display JAR info complete [PortalLauncher]Browser: sun.plugin [PortalLauncher]Vendor: Sun Microsystems, Inc. [PortalLauncher]Version: 1.1 [PortalLauncher]Portal Launcher started (version:20111205) [PortalLauncher]Vendor: Sun Microsystems, Inc. [PortalLauncher]Version: 1.1 java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.sun.plugin.javascript) at java.security.AccessControlContext.checkPermission(Unknown Source) at java.security.AccessController.checkPermission(Unknown Source) at java.lang.SecurityManager.checkPermission(Unknown Source) at java.lang.SecurityManager.checkPackageAccess(Unknown Source) at sun.applet.AppletSecurity.checkPackageAccess(Unknown Source) at java.lang.ClassLoader$1.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at java.lang.ClassLoader.checkPackageAccess(Unknown Source) at java.lang.Class.getDeclaredConstructors0(Native Method) at java.lang.Class.privateGetDeclaredConstructors(Unknown Source) at java.lang.Class.getConstructor0(Unknown Source) at java.lang.Class.newInstance0(Unknown Source) at java.lang.Class.newInstance(Unknown Source) at sun.applet.AppletPanel.createApplet(Unknown Source) at sun.plugin.AppletViewer.createApplet(Unknown Source) at sun.applet.AppletPanel.runLoader(Unknown Source) at sun.applet.AppletPanel.run(Unknown Source) at java.lang.Thread.run(Unknown Source) basic: Ausnahme: java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.sun.plugin.javascript) Ignored exception: java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.sun.plugin.javascript) [PortalLauncher]Portal Launcher started (version:20111205) [PortalLauncher]Starting heartbeat.... [PortalLauncher]heartbeat started [PortalLauncher]Build=1.00-b140 [PortalLauncher]Heartbeat started [PortalLauncher]Starting heartbeat.... [PortalLauncher]heartbeat started [PortalLauncher]Build=1.00-b140 [PortalLauncher]Heartbeat started

This is all happining as the page loads. There are 2 identical applets being started. One applet is able to seach and load a certificate but the other cannot.

applet 1:
security: Zertifikate wurden aus Bereitstellungssitzungs-Zertifikatspeicher geladen ***** Checking if certificate is in Deployment permanent certificate store security: Zertifikate werden aus Internet Explorer TrustedPublisher-Zertifikatspeicher geladen ***** Loading certificates from Deployment session certificate store

applet 2:
security: Zertifikat wird im permanenten Bereitstellungszertifikatspeicher gesucht ***** Checking if certificate is in Deployment permanent certificate store [PortalLauncher] Version20111205 .... [PortalLauncher]Version: 1.1 java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.sun.plugin.javascript) at java.security.AccessControlContext.checkPermission(Unknown Source)

Can anyone help?

Hi

what tools are available for implementing security?

I am imagining an application to handle various areas of data such as customers, deliveries, invoices, parts etc. Each user will have quite different rights in each area. e.g. can create a new customer but can only view invoices and has no access at all to parts.

Are there any guidelines and frameworks to speed up the implementation of this?

Paul

When must a stream be explicity closed?

Consider
public JSPParser(File file) throws FileNotFoundException, UnsupportedEncodingException { this(new InputStreamReader(new FileInputStream(file), "UTF8")); }

Does this need to be closed?

What about
InputStream in = myclass.getClass().getResourceAsStream("resource.txt");

I think the first example is safe - the close will be done on finalize.
The second example does need a close.

Am I wrong?

Budi

what, in your opinion, are the 3 most significant improvements in Struts 2 compared to Struts the First?

Thanks

Paul

To be a bit more specific...

The application is a front-end to a wide range of legacy data. It allows the user to search for information from this pool and the results of n different queries are presented in the browser. Because the input criteria are quite loose it is possible that some queries will run too long. The idea behind using threads was to set all queries running in parallel and to use the parent thread to cut-off after a certain time.

The warning which I am getting from Websphere seems to be EJB specific but we don't use EJBs. Here is the text:

J2CA0075W: An active transaction should be present while processing method allocateMCWrapper. J2CA0075W: An active transaction should be present while processing method initializeForUOW

Technote

Problem
Application gets the following warning messages in the SystemOut.log:

[4/11/03 11:53:41:711 PDT] 891a0 ConnectionMan W J2CA0075W: An active transaction should be present while processing method allocateMCWrapper.
[4/11/03 11:53:41:815 PDT] 891a0 ConnectionMan W J2CA0075W: An active transaction should be present while processing method initializeForUOW.

Cause
These messages are being produced due to an "unsupported" environment. When application has spun its own threads from an EJB, accessing a database is not supported (per the J2EE specification). If a Servlet is spinning its own threads and accessing a database, the J2EE specification is not clear on this, so WebSphere Application Server 5.0 will allow it at this time. IBM is working with Sun to clarify this in the specification, so eventually (i.e. J2EE 1.4) spun threads from a Servlet accessing a database outside of a transaction will not be supported either.
Since we don't want to promote the usage of these "naked" threads accessing databases, we are producing the warning messages. Although they may be filling up the logs, we feel that these are necessary to warn the user that they are doing something not in-line with the intended usage. Customers should consider changing their application to comply with the
J2EE specification.

Paul

Hi

I have a servlet which spawns a number of threads which perform database queries. The main thread acts as a kind of watchdog and cuts-off long running queries after a certain time. Note I am using JDBC and there are no EJBs.

We are in the process of migrating from Websphere 4 to Websphere 5 and I am now getting warnings which basically say that threads in servlets are not J2EE conform and that support for threads may be withdrawn completely in the future.

Does anyone have any opinons on this? Was it a bad idea to use threads in the first place? Are there better ways to ignore long-running queries?

Thanks!

Paul

Darren,

I'm wondering if the Eclipse RCP offers a suitable way of managing plug-ins automatically (i.e. without user intervention). It's on my list of things to look at...

Paul

Are you sure that there's a problem with SWT?

This article suggests it's possible:
Deploy an SWT application using Java Web Start

I have tried it out and it seems to work ok...

Assuming SWT is not a problem - is it possible to deploy an Eclipse RCP application via WebStart?


paul

Hi,

Is anyone using WebStart to distribute Eclipse RCP applications? Is it even possible?


TIA

Paul

Hi,

Does anyone have experience accessing a Struts-based application using different client technologies (Browser, Swing, Rich-Client-Platform etc.)

We want to replace many 3270 terminal-based applications with web-based applications. Many users will just want to access information (Browser) but some will need to perform many update actions. I think the browser environment is not comfortable enough for that kind of action and we're thinking of a Swing or RCP front-end for those (in-house) users.

Comments anyone?

Thanks
Paul

ANT is running in text mode, the JUnit task is too.