OCJWCD

<jsp:doBody varReader="mybody" var="mybodystr" scope="page"/>

<jsp:invoke fragment="attrName" />

1. request                  javax.servlet.ServletRequest
2. reponse                 javax.servlet.ServletResponse
3. session                  javax.servlet.http.HttpSession
                                    if session="false" this will be <null>
4. jspContext           javax.servlet.jsp.JspContext
5. application          javax.servlet.ServletContext
6. config                    javax.servlet.ServletConfig
7. out                          javax.servlet.jsp.JspWriter

1. BASIC
2. DIGEST
3. FORM
4. CLIENT-CERT

<form method="POST" action="j_security_check">
   <input type="text" name="j_username" />
   <input type="password" name="j_password" />
</form>

<login-config>
   <auth-method>BASIC, DIGEST, FORM or CLIENT-CERT</auth-method>
   <realm-name>Human readable name</realm-name>
   <form-login-page>
      <form-login-page>/login.html</form-login-page>
      <form-error-page>/errors/403.html</form-error-page>
   </form-login-page>
</login-config>

<form-login-page> is only used for FORM authentication method.
Both childs <form-login-page> and <form-error-page> are mandatory

<security-role>
   <role-name>manager</role-name>
</security-role>

Zero or many are allowed.

@DeclareRoles({"admin", "user")

@DeclareRoles({"admin"})
@DeclareRoles("admin")

<security-constraint>
   <web-resource-collection>
      <web-resource-name>shoppingbasket</web-resource-name>
      <description>Shopping basket resources</description>
      <url-pattern>/basket/*</url-pattern>
      <http-method>PUT</http-method>
      <http-method>POST</http-method>
   </web-resource-collection>
</security-constraint>

Exactly ONE <web-resource-collection> for every <security-constraint>

<security-constraint>
   <auth-constraint>
      <role-name>role1</role-name>
      <role-name>role2</role-name>
   </auth-constraint>
</security-constraint>

ZERO or ONE <auth-constraint> for every <security-constraint>

<security-constraint>
   <user-data-constraint>
      <transport-guarantee>NONE</transport-guarantee>
   </user-data-constraint>
</security-constraint>

ZERO or ONE <user-data-constraint> for every <security-constraint>

1. NONE (default)
2. INTEGRAL (Digest)
3. CONFIDENTIAL (SSL)

@ServletSecurity {
   value = @HttpConstraint(value=PERMIT | DENY, transportGuarantee=NONE | CONFIDENTIAL, rolesAllowed = { "admin" }),
   httpMethodConstraints = {
      @HttpMethodConstraints(value="HTTP-Method", emptyRoleSemantic=PERMIT | DENY, transportGuarantee= NONE | CONFIDENTIAL, rolesAllowed = { "admin" } 
   }
}

<servlet>
   <security-role-ref>
      <role-name>servlet_role</role-name>
      <role-link>web_server_role<role-link>
   </security-role-ref>
</servlet>

web_server_role must be defined with <security-role>

ONE or MANY <security-role-ref> are allowed.

<jsp:include page="page.jsp" flush="false" />

<jsp:forward page="page.jsp" />

<jsp:param name="param_name" value="param_value"  />

1. pageContext
2. pageScope               JspContext.getAttribute()
3. requestScope          ServletRequest.getAttribute()
4. sessionScope           HttpSession.getAttribute()
5. applicationScope     ServletContext.getAttribute()
6. param                      ServletRequest.getParameter()
7. paramValues            ServletRequest.getParameterValues()
8. header                     ServletRequest.getHeader()
9. headerValues           ServletRequest.getHeaders()
10. cookie                      HttpServletRequest.getCookies()
11. initParam                 ServletContext.getInitParameter()

All are of type Map except pageContext: PageContext 

1. Loading
2. Instantiation
3. Initialization
   • void init(ServletConfig config)
     throws ServletException
4. Processing
   • void service(ServletRequest request, ServletResponse response) 
     throws java.io.IOException, ServletException
5. Destruction
   • void destroy()

Methods declared in interface javax.servlet.Servlet

<context-param>
   <param-name>Name</param-name>
   <param-value>Value</param-value>
</context-param>
 

<servlet>
   <servlet-name>Name</servlet-name>
   <servlet-class>package.MyClass</servlet-class>
   <init-param>
      <param-name>Name</param-name>
      <param-value>Value</param-value>
   </init-param>
</servlet>
 

• String getServletContext().getInitParameter("Name");
• String getServletConfig().getServletContext().getInitParameter("Name");

• Enumeration<String> getServletContext().getInitParameterNames()

• String getServletConfig().getInitParameter("Name");
• String getInitParameter("Name");

• Enumeration<String> getServletConfig().getInitParameterNames();
• Enumeration<String> getInitParameterNames();

Cookie will expire after 5 Seconds

Cookie will be deleted when web browser exits

Cookie will be deleted

Returns RequestDispatcher object to welcome.jsp

Throws IllegalArgumentException because "/" is missing!

Returns RequestDispatcher object absolute to root

Returns RequestDispatcher object relative to request url

<servlet>
   <servlet-name>myservlet</servlet-name>
   <servlet-class>package.MyServlet</servlet-class>
      <init-param>
         <param-name>myParam</param-name>
          <param-value>mike</param-value>
      </init-param>
</servlet>

<servlet-mapping>        
   <servlet-name>myservlet</servlet-name>
   <url-pattern>/myservlet/*</url-pattern>
</servlet-mapping>

@WebServlet(
    name="myservlet",
    urlPatterns={"/myservlet/*"},
    initParams={ @WebInitParam(name="myParam", value="mike") }))

class MyServlet extends HttpServlet {
...

<filter>        
   <filter-name>myfilter</filter-name>        
   <filter-class>package.MyFilter</filter-class>        
   <init-param>            
       <param-name>logType</param-name>            
       <param-value>special</param-value>        
   </init-param>    
</filter>

<filter-mapping>        
   <filter-name>logSpecial</filter-name>        
   <url-pattern>*.special</url-pattern>    
</filter-mapping>

@WebFilter(
    urlPatterns={"*" },
    initParams={ @WebInitParam(name="myParam", value="mike") }))

public class MyFilter implements javax.servlet.Filter {
...

<listener>
   <listener-class>package.MyListener</listener-class>
</listener>

@WebListener
public class MyListener implements ServletContextListener {

..

Usage
Context has been created or destroyed

Package
javax.servlet

Deployment Descriptor
yes

Methods

• contextInitialized(ServletContextEvent)
• contextDestroyed(ServletContextEvent)