1. ©SoftMoore ConsultingSlide 1 Filters

2. Filters can be used in a web application to intercept, examine, and possibly transform requests or responses associated with servlets, JSP pages HTML pages, etc. Filters can be used to –query the request and act accordingly –block the request and response pair from passing any further –modify the request headers and data, providing a customized version of the request –modify the response headers and data, providing a customized version of the response. Think of filters as a chain of steps that requests and responses must go through before reaching a servlet, JSP page, or HTML page. ©SoftMoore ConsultingSlide 2

3. Filters in Action ©SoftMoore ConsultingSlide 3 Filter 1 HTML Page Filter 2Servlet Client (browser) HTTP Request HTTP Response Server Client (browser) HTTP Request HTTP Response JSP Page

4. Possible Uses of Filters Authentication – blocking requests based on user identity. Logging and auditing – tracking users of a web application. Image conversion – scaling maps, and so on. Data compression – making downloads smaller. Localization – targeting the request and response to a particular locale. Transformations of XML content – targeting web application responses to more than one type of client. ©SoftMoore ConsultingSlide 4

5. Creating a Filter Create a class that implements Filter interface. Methods doFilter() – most important method init() destroy() Put filtering behavior in the doFilter() method. Arguments ServletRequest ServletResponse FilterChain Call the doFilter() method of the FilterChain argument to invoke the next filter (if any) or the actual resource. ©SoftMoore ConsultingSlide 5

6. Creating a Filter (continued) Modify the deployment descriptor ( web.xml ) to register the filter with the appropriate servlets and JSP pages. (Use filter and filter-mapping elements in web.xml.) ©SoftMoore ConsultingSlide 6

7. Example: Logging User Access package com.softmoore.filters; import java.util.Date; public class LoggingFilter implements Filter { private FilterConfig filterConfig = null; public void init(FilterConfig filterConfig) throws ServletException { this.filterConfig = filterConfig; } public void destroy() { this.filterConfig = null; } ©SoftMoore ConsultingSlide 7

8. Example: Logging User Access (continued) public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws ServletException, IOException { HttpServletRequest req = (HttpServletRequest) request; String message = req.getRemoteHost() + " accessed " + req.getRequestURL() + " on " + new Date() + "."); filterConfig.getServletContext().log(message); chain.doFilter(request,response); } ©SoftMoore ConsultingSlide 8

9. Modifying web.xml for the Logging Filter LoggingFilter com.softmoore.filters.LoggingFilter LoggingFilter /index.jsp ©SoftMoore ConsultingSlide 9

10. Example: Restricting User Access public class AccessFilter implements Filter { private static final String LOGIN_PAGE = "/myLogin.jsp";... public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest req = (HttpServletRequest) request; HttpServletResponse res = (HttpServletResponse) response; boolean authorized = false; HttpSession session = req.getSession(true); User user = (User)session.getAttribute("webapp.user"); ©SoftMoore ConsultingSlide 10

11. Example: Restricting User Access (continued) if (user != null && user.isValid()) authorized = true; if (authorized) { chain.doFilter(request, response); } else { // save requested URI in session for login servlet session.setAttribute("requestUri", req.getRequestURI().toString()); RequestDispatcher dispatcher = req.getRequestDispatcher(LOGIN_PAGE); dispatcher.forward(request, response); } ©SoftMoore ConsultingSlide 11

12. Declaring/Maping a Filter in web.xml AccessFilter com.softmoore.security.AccessFilter AccessFilter /admin/* /reports/* ©SoftMoore ConsultingSlide 12

13. Using Annotations to Declare/Map Filters Introduced in servlet API version 3.0, the annotation @WebFilter can be used to declare a servlet class and map it to a URL. Example @WebFilter("/admin/*", "/reports/*") public class AccessFilter implements Filter {... } Note that the class must still implement interface Filter. ©SoftMooreSlide 13

14. Using Annotations to Declare/Map Filters (continued) Annotation @WebFilter replaces equivalent and configuration elements in the web deployment descriptor file ( web.xml ) Servlet containers process the annotated classes when the application is deployed. ©SoftMooreSlide 14 Note: Several additional annotations were also introduced in servlet API 3.0; e.g., @WebServlet and @WebListener.

15. Annotations versus Deployment Descriptor Similar to servlets Primary advantage of using annotations to declare/map filters − eliminates a lot of boilerplate XML Primary advantage of using the deployment descriptor to declare/map filters − improved server startup performance when using a lot of filters (provided attribute metadata-complete has been set to true). ©SoftMooreSlide 15

16. Useful Filters CompressionFilter and other filter examples available in Tomcat distribution (Google for variations available on the web) BadInputFilter revisited (John Moore, JavaWorld) http://www.javaworld.com/article/2078901/open-source-tools/badinputfilter-revisited.html WebFilter annotation examples http://www.codejava.net/java-ee/servlet/webfilter-annotation-examples “Two Servlet Filters Every Web Application Should Have” by Jayson Falkner http://onjava.com/pub/a/onjava/2003/11/19/filters.html ©SoftMoore ConsultingSlide 16