Bax Fos

Hello Community,

I stuck with a problem I can't find a solution to and I already tried to get help on stackoverflow (https://stackoverflow.com/questions/49572255/how-to-restore-a-session-in-a-servlet-created-in-another-on-glassfishv4) but because nobody could help me there I would like to ask here too, maybe here are the experts that can point out what I am doing wrong.
I am using Servlets to provide a webservice to an android app. My problem is that I create two objects in my LogonServlet which I would like to restore in my other servlets:

What I am aiming to do:

I want to create different servlets. One of these is my LogonServlet which creates and Object which deals with RFCs to a SAP. This object I want to restore on my other servlets for the same session.

What I have done so far:

LogonServlet: (no real user authentification because I am still testing functionality)
protected void doPost(HttpServletRequest request, HttpServletResponse response)        throws ServletException, IOException {    HttpSession hs = request.getSession(true);    TypeToken type = new TypeToken<LinkedList<Pair>>() {};    HttpServletStream hss = new GsonServletStream<LinkedList>(request, response, type);    LinkedList<Pair> ll = (LinkedList<Pair>) hss.getRequest();    LinkedList<String> valueList = new LinkedList();    ll.forEach(e -> valueList.add((String) e.getValue()));    SapRfcTest rfc = new SapRfcTest(new SapConnectionTest(valueList.get(0), valueList.get(1), " ", " ", " ", " "));    hs.setAttribute("rfc", rfc);    hs.setAttribute("hss", hss);    (ll = new LinkedList()).add(new Pair("Response", "Success"));    hss.createResponse(ll); }

The code of a different servlet to restore the session variables:

protected void doPost(HttpServletRequest request, HttpServletResponse response)        throws ServletException, IOException {      HttpSession hs = request.getSession(false);    if (hs == null) {        sendFailure("Session not found", request, response);    }    SapRfcTest rfc = (SapRfcTest) hs.getAttribute("rfc");    HttpServletStream hss = (HttpServletStream) hs.getAttribute("hss");    if (rfc == null || hss == null) {        sendFailure("One or more session variables not found", request, response);    }

The problem is that it always returns "null" for the session.

This is my web.xml
<?xml version="1.0" encoding="UTF-8"?> <!-- Java Servlet Specification version 3.1 final document has an old example    of only version 2.5. This website (http://antoniogoncalves.org/2013/06/04/java-ee-7-deployment-descriptors/)    provided the updated example of the web-app tag --> <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" version="3.1">  <display-name>Archetype Created Web Application</display-name>  <servlet>    <servlet-name>LogonServlet</servlet-name>    <servlet-class>de.astronergy.webservice.LogonServlet</servlet-class>  </servlet>  <servlet>    <servlet-name>GetStorageLocationListServlet</servlet-name>    <servlet-class>de.astronergy.webservice.GetStorageLocationListServlet</servlet-class>  </servlet>  <servlet>    <servlet-name>RelocateContainerServlet</servlet-name>    <servlet-class>de.astronergy.webservice.RelocateContainerServlet</servlet-class>  </servlet>  <servlet-mapping>    <servlet-name>LogonServlet</servlet-name>    <url-pattern>/LogonServlet</url-pattern>  </servlet-mapping>  <servlet-mapping>    <servlet-name>GetStorageLocationListServlet</servlet-name>    <url-pattern>/GetStorageLocationListServlet</url-pattern>  </servlet-mapping>  <servlet-mapping>    <servlet-name>RelocateContainerServlet</servlet-name>    <url-pattern>/RelocateContainerServlet</url-pattern>  </servlet-mapping>  <servlet>    <description></description>    <display-name>GetInformationToBarcodeServlet</display-name>    <servlet-name>GetInformationToBarcodeServlet</servlet-name>    <servlet-class>de.astronergy.webservice.GetInformationToBarcodeServlet</servlet-class>  </servlet>  <servlet-mapping>    <servlet-name>GetInformationToBarcodeServlet</servlet-name>    <url-pattern>/GetInformationToBarcodeServlet</url-pattern>  </servlet-mapping> </web-app>

I have no clue what I am doing wrong. It could be some setup I need to activate in glassfish v4 or something I have to do in the client that the server knows I would like to continue the session. This is my first project with javaEE, glassfish and servlets.

Thank you very much in advance.

Where do I get the certificate to sign it?
I want to provide a webservice via glassfish v4 with a servlet which just a chosen number of user can connect to. These users already have the public key on their devices (manually installed).
Since I am completly new to JavaWebservices and all this server stuff I would be happy if you could explain in detail if you know something about it.

I have some problems about what the actual signing process does. Asymetric cryptography is completly clear to me atleast from a mathematical point of view.

When I know create a private and a public key and keep the private one and give the public one away to people I would like to communicate with they can encrypt the information with this key and I can decrypt the messages with my key.

So where is the use of signing a key, especially self-signing a key and what is exaclty done when a key got signed?

PS.: I just randomly picked one of the subforum because I have no plan which fitts with my needs. I want to setup a glassfish v4 server that lets only access users to a servlet with already own the public key or whatever the signing process does with the public key. I am like reading a million tutorials which use different keytools make different suggestions and tell me about this or that shouldn't be used in practice but we doing it here anyway stuff. I have no idea how to reach my goal atm. :/

I am currently learning how to use JavaEE stuff and currently trying to create a GlassFish-Server (up and running) that has attached a Servlet. The Servlet should present a Login-Page and after Login the users are allowed to add words they tipe into a field to a list.

Important is that the connection should be secure in every aspect means I would like to use HTTPS (mutual). Also I read that HTTPS has weaknesses like side-channel-attacks. This should be preventable/reduceable by using stateless communictaion?

* I would like to get some hints where I can find information about Glassfish-Configuration for HTTPS?
* What do I need to do to make my Servlet working with HTTPS?
* Is it possible to keep up a session over time with stateless communication?
* Are there other things I have to take care of?

I am using Eclipse, JavaEE7, GlassFish and creating a Servlet with the by Eclipse given defaults for "dynamic web project". I already created simple servlets running on the Server using HTTP.

I would appreciate some help - literature hints. Maybe a step by step intstruction. Some basic Ideas about security concepts etc.

----
I am from Germany and I am happy if you correct my English because it is the only way to improve it.