HttpOnly settings can be done in application having servlet api-2.5 and web.xml 2.5 version? - security

wanna enable httpOnly attribute to session cookie for our application. we are using servlet-api 2.5 version and web.xml as 2.5 .. now i have tried adding below code in web.xml
<cookie-config>
<http-only>true</http-only>
</cookie-config>
i got error parsing error in web.xml at <cookie-config>
can any please help on this.. do i need to update servlet version to 3 and web.xml to 3 as well ...
or any other ways to do it writing in java code itself.. we are using jboss 5 version..

Related

ViewExpiredException despite high session timeout

for my Portlet(*) I'm getting "ViewExpiredException"s although my session-timeout in ROOT/WEB-INF/web.xml is set with 600 (minutes).
The (portletapp)/WEB-INF/web.xml has no session-timeout configured.
Also there is no configuration like
session.timeout=30
in a portal.properties like mentioned in https://www.liferay.com/de/community/wiki/-/wiki/Main/Session+Timeout
Regarding the exception I'm currently planning to set
<context-param>
<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>client</param-value>
</context-param>
But I'd like to understand the problem. Where can I find other session-timeout configurations, or is this a default I need to overwrite?
Regards,
Gunnar
(*) Liferay 6.2 EE SP10 on Tomcat 7.0.42, Mojarra 2.1.29, Portlet 2.0, Servlet 2.5, jstl 1.2.1, facelets 1.1.15, Primefaces 5.0
Update: Maybe I found the solution after more searching: Default session timeout for Apache Tomcat applications
(Tomcat's default session timeout in conf/web.xml)
Update: Problem not solved, own answer deleted.
I just got the "ViewExpiredException" again.
I added debug logging of
"maxInactiveInterval: " + PortalUtil.getHttpServletRequest(((PortletRequest)FacesUtil.getExternalContext().getRequest())).getSession().getMaxInactiveInterval()
and I see my 600 configured minutes as 36000 seconds.
Any hints why I keep getting "ViewExpiredException"s?
My next try will be the portal.properties-entry mentioned above.

Implementing EL 2.2 on tomcat 6

I was trying to enable EL 2.2 on tomcat 6.0.41 on windows 7.
I read this: http://wiki.apache.org/myfaces/HowToEnableEl22
and this: JSF - call method with parameter (tomcat6)
and this: org.apache.jasper.JasperException: The function test must be used with a prefix when a default namespace is not specified
and also this: Can EL 2.2 capable JSF web applications be deployed to shared Tomcat 6 hosting environment?
and tried to follow them all but with no luck, I still get the following error:
org.apache.jasper.JasperException: /DashBoard.jsp(234,7) The function
setSelectedExperiment must be used with a prefix when a default
namespace is not specified
on this line of code:
action="#{dashBoardController.setSelectedExperiment(experiment)}"
I did the following:
downloaded the el jars from here:
http://download.java.net/maven/2/javax/el/el-api/2.2/el-api-2.2.jar
http://download.java.net/maven/2/org/glassfish/web/el-impl/2.2/el-impl-2.2.jar
and put them under WEB-INF/lib
I removed el-api.jar from tomcat6/lib
i added this to web.xml:
<context-param>
<param-name>com.sun.faces.expressionFactory</param-name>
<param-value>com.sun.el.ExpressionFactoryImpl</param-value>
</context-param>
all according to the guidelines in apache wiki
Yet, as I said, I get the error above.

CometD demo on JBoss 6

I am planning to use Cometd library in my application that runs on JBoss AS 6. Therefore I downloaded cometd 2.4.0 and tried to deploy example war (from cometd-demo/target) to my AS. I was aware that this was not possible without modifications, so I did the changes in web.xml:
Changed to servlet 3.0 in web-app tag (it is originally 2.5). Used complete tag from CometD faq answer. Also uncommented continuation filter that was already in web.xml, based on this description
Based on faq answer, added async-supported tag. However, this causes problems: if I just uncomment it, web.xml can't be parsed. I found out that this is due to order of tags in XML, so moved async-supported tag down the order, just after load-on-startup tag. However, Jboss still throws exceptions:
ERROR
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost].[/cometd-demo-2.4.0].[cometd]]
Servlet.service() for servlet cometd threw exception:
java.lang.IllegalStateException: The servlet or filters that are being
used by this request do not support async operation
ERROR
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost].[/cometd-demo-2.4.0].[cometd]]
Servlet.service() for servlet cometd threw exception:
java.lang.ClassNotFoundException:
org.eclipse.jetty.server.AbstractHttpConnection from
BaseClassLoader#12a54b
Complete web.xml file that I use is here.
Example runs no my Jboss despite all errors reported, but by watching firebug, I can see that it does quick pooling instead of long pool. It seems that server thinks that browser has multiple connections open, which is not the case (see JSON below):
[{"id":"137","successful":true,"advice":{"interval":2000,"reconnect":"retry","multiple-clients":true,"timeout":20000},"channel":"/meta/connect"}]
Did anyone managed to make examples work with JBoss as6 and how? What I did wrong here?
remove:
<!-- Portability Filter, needed only to run on non Jetty or non Servlet-3.0 containers -->
<filter>
<filter-name>continuation</filter-name>
<filter-class>org.eclipse.jetty.continuation.ContinuationFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>continuation</filter-name>
<url-pattern>/cometd/*</url-pattern>
</filter-mapping>
from web.xml
I have the same setup and the same problem even if I remove continuation filter from web.xml.
I've found a thread on cometd-users group complaining about multiple-client issue on Tomcat 7 and the cause seems to be a Tomcat bug around Content-Type that is not set to "application/json".
However I've inspected packets and on JBossAS6 the content-type is correctly set on server responses.
UPDATE
I've give a try using Jetty 7 and the problem disappeared. The "multiple-clients" issue affects Tomcat as well as JBoss6 AS

Oracle WebLogic GroovyServlet Error

We have a J2EE app running beautifully on tomcat-based app servers, but all groovy scripts seem to fail on weblogic (10.3.5.0) and also IBM WebSphere. It seems the script processing, not the content of the scripts are the issue. The app itsells is a spring MVC web app and the GroovyServlet is part of the web.xml descriptor:
<!-- Servlets -->
<servlet>
<servlet-name>Groovlet</servlet-name>
<servlet-class>groovy.servlet.GroovyServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Groovlet</servlet-name>
<url-pattern>*.groovy</url-pattern>
</servlet-mapping>
Calling a simple executor.groovy file results in an exception. My test script is small:
response.contentType = "application/json"
out.println "test"
But fails:
GroovyServlet Error: script: '/executor.groovy': Script processing failed.null
java.lang.NullPointerException
Anyone has a solution? Are there general issues with Groovy on weblogic or websphere?
Don't know if you're still having this issue :)
I had the same problem - the NullPointerException is caused by ServletContext.getRealPath(...) returning null.
There is a setting in Weblogic admin console which controls whether getRealPath() can be used.
It can also be configured in your weblogic.xml file by inserting the following (not sure how to deal with this in Websphere).
<container-descriptor>
<show-archived-real-path-enabled>true</show-archived-real-path-enabled>
</container-descriptor>
Sounds like response or out are not properly binded in weblogic. Did you try your servlet on another container. Also publishing more about the stacktrace and the web.xml could help

How to upload files in JSF 1.1?

I want to upload files in a JSF 1.1 project. JSF 1.1 doesn't support RichFaces file upload. I looked at Tomahawk, but I don't know how to use Tomahawk. Can anybody explain for me?
Which JARs do I have to use?
And taglibs?
And web.xml configuration?
And faces-config.xml configuration?
Or are there alternatives to Tomahawk?
Which JARs do I have to use?
The following ones:
tomahawk
commons-fileupload
commons-io
commons-logging
commons-el
I assume that you already have the JSF 1.1 JARs jsf-api and jsf-impl.
And taglibs?
Just the Tomahawk one, next to the two usual core/html tags:
<%# taglib uri="http://myfaces.apache.org/tomahawk" prefix="t" %>
And web.xml configuration?
You need the ExtensionsFilter. This filter will take care that JSF gets the right parameters out of a multipart/form-data request body.
<filter>
<filter-name>Extensions Filter</filter-name>
<filter-class>org.apache.myfaces.webapp.filter.ExtensionsFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>Extensions Filter</filter-name>
<servlet-name>Faces Servlet</servlet-name>
</filter-mapping>
And faces-config.xml configuration?
Nothing special. Just create a managed bean the usual way with a UploadedFile property which you bind to the value attribute of <t:inputFileUpload>.
See also:
How to upload files in JSF? (yes, it's targeted on JSF 1.2, but should work equally good in JSF 1.1).

Resources