You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Steve Procter <sp...@sanasecurity.com> on 2004/11/30 00:32:05 UTC
Delivering JSPs without source
We have a web application that uses jsps. We want to deliver the
application to the customer without source for the jsps. We have done
this in the past by putting all of the compiled jsps into a jar file.
Recently we had to move the application jar files from
webapps/appname/WEB-INF/lib to common/lib because we implemented our own
realm which uses our object repository; since it has to be installed in
server/lib, the code for the repository cannot be installed under the
web application directory.
When the application is installed in common/lib it is not able to load
the compiled jsp files. They are installed in common/lib/.
Does anyone have an idea about why these classes are not visible?
Thanks,
--Steven
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by Justin Ruthenbeck <ju...@nextengine.com>.
At 09:11 PM 11/30/2004, you wrote:
> > It would seem that if a web page request comes in for a .jsp page,
>Tomcat would have no file to compare the date against in your scheme of
>putting the compiled .jsp page in a .jar file only.
This is only done for non-compiled jsp files that are served by the
JspServlet (mapped to *.jsp in the global web.xml). When the jsps are
precompiled, the servlets they become are mapped in your own web.xml,
meaning they are treated *exactly* like servlets and no date, compiling,
or other shenanigans are done.
>How do most companies deploy their web applications? Do they include
>the source code for the jsps? Almost all of the companies I have worked
>for have been very protective of their source code and won't allow it to
>be released.
I'm still not clear as to why you have to put your compiled JSPs in
common/lib. I understand that some of your classes much be there, but
why won't you split your classes into multiple jars? The "normal" way
this is done is to precompile the jsps, bundle them into
/WEB-INF/lib/myapp-jsp-compiled.jar, bundle the majority of your POJO to
/WEB-INF/lib/myappcore.jar, and bundle your container service
implementation classes (custom realms, valves, anything the main
classloader needs) into /common/lib/app-container.jar. Will this not
work in your case?
justin
______________________________________________
Justin Ruthenbeck
Lead Software Engineer, NextEngine Inc.
justinr - AT - nextengine DOT com
Confidential. See:
http://www.nextengine.com/confidentiality.php
______________________________________________
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by Steve Procter <sp...@sanasecurity.com>.
> There is no reason why your app wouldn't be able to find classes from
a jar in common/lib -- there's something else going on here.
I agree.
The following comment in the WebappClassLoader javadoc might be relevant.
"IMPLEMENTATION NOTE - Due to limitations in Jasper compilation
technology, any repository which contains classes from the servlet API
will be ignored by the class loader."
I'm not sure whether the repository it refers to is a single jar file or
the entire set of directories and jar files that this class loader handles.
All of the class files are in common/lib so I don't believe the
WebappClassLoader is involved in loading these classes. But the comment
matches my experience. In earlier versions of the product the product
classes were all installed under webapps and the system loaded the
precompiled jsps fine. After we moved all of the classes to common/lib
the jsps stopped loading.
> It would seem that if a web page request comes in for a .jsp page,
Tomcat would have no file to compare the date against in your scheme of
putting the compiled .jsp page in a .jar file only.
I agree with this, also. That matches what I step through the jsp
loader in my debugger. When it tries to load the jsp file the first
thing it does is look for an already loaded JspServletWrapper object.
If it doesn't find one, it checks to see if the file exists and if not
gives up.
So, unless something else is loading the compiled jsp sevlets into the
list of known jsps, I don't think the system will load the compiled
servlet unless it can find the jsp file, or at least a file with the
correct name and an older modify time than the compiled version.
How do most companies deploy their web applications? Do they include
the source code for the jsps? Almost all of the companies I have worked
for have been very protective of their source code and won't allow it to
be released.
Thanks for the help,
--Steven
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by Justin Ruthenbeck <ju...@nextengine.com>.
Hi Steve,
Hopefully I read your question right. There is no reason why your app
wouldn't be able to find classes from a jar in common/lib -- there's
something else going on here. Do you have duplicate copies of these
classes anywhere? Do these classes rely on other classes found only in
the /webapp/WEB-INF/lib jars or /webapp/WEB-INF/classes?
This particular issue aside, there's no good reason why you should have
to place your JSPs in common/lib. If there are other classes in your jar
which have to be there (custom realm impl, for example), then break those
out into a separate jar and keep your compiled JSPs in a separate jar in
WEB-INF/lib. ... and if you find that your realm is being somehow
implemented in the JSP, you know you're really screwed. :)
justin
At 03:32 PM 11/29/2004, you wrote:
>We have a web application that uses jsps. We want to deliver the
>application to the customer without source for the jsps. We have done
>this in the past by putting all of the compiled jsps into a jar file.
>
>Recently we had to move the application jar files from
>webapps/appname/WEB-INF/lib to common/lib because we implemented our own
>realm which uses our object repository; since it has to be installed in
>server/lib, the code for the repository cannot be installed under the
>web application directory.
>
>When the application is installed in common/lib it is not able to load
>the compiled jsp files. They are installed in common/lib/.
>
>Does anyone have an idea about why these classes are not visible?
>
>Thanks,
>
>--Steven
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
______________________________________________
Justin Ruthenbeck
Lead Software Engineer, NextEngine Inc.
justinr - AT - nextengine DOT com
Confidential. See:
http://www.nextengine.com/confidentiality.php
______________________________________________
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by David Stevenson <ds...@rochester.rr.com>.
One person suggested putting all your logic in .java files.
Make your .jsp's like this:
<% page import="com.yourcompany.YourJavaClass" %>
<%
YourJavaClass.YourJavaMethod ( request, response, config, application,
session, out ) ;
%>
YourJavaClass.java contains:
package com.yourcompany.YourJavaClass ;
public class YourJavaClass
{
public void YourJavaMethod ( HttpServletRequest request,
HttpServletResponse response, ServletConfig config, ServletContext
application, HttpSession session )
{
// Your logic here.
}
}
David Stevenson
On Tue, 2004-11-30 at 00:14, parviz wrote:
> I'm a little confused as to what you mean by object repository.
> You have your Realm in common/lib which is fine. All the other
> Realm(jdbc,jndi...) exist in common/lib. I'm not clear what your Realm
> does with your object repository? whats the connection between these
> two?Does your compiled jsp files exist in that directory as well?
>
> I'll try to setup something similar to your setup and see if I can come
> up with any solution unless someone has any by now.
>
> Parviz
>
> On Mon, 2004-11-29 at 15:32, Steve Procter wrote:
> > We have a web application that uses jsps. We want to deliver the
> > application to the customer without source for the jsps. We have done
> > this in the past by putting all of the compiled jsps into a jar file.
> >
> > Recently we had to move the application jar files from
> > webapps/appname/WEB-INF/lib to common/lib because we implemented our own
> > realm which uses our object repository; since it has to be installed in
> > server/lib, the code for the repository cannot be installed under the
> > web application directory.
> >
> > When the application is installed in common/lib it is not able to load
> > the compiled jsp files. They are installed in common/lib/.
> >
> > Does anyone have an idea about why these classes are not visible?
> >
> > Thanks,
> >
> > --Steven
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
> >
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by sven morales <ak...@yahoo.com>.
Hi,
If I understood your issue, you have some required
jars installed at tomcatX/server/lib because of some
reason you can not have it at yourapp/WEB-INF/lib? And
your issue is this is not accessable from your apps,
which seems to be the correct behaviour per the:
http://jakarta.apache.org/tomcat/tomcat-5.0-doc/class-loader-howto.html
Catalina - This class loader is initialized to include
all classes and resources required to implement Tomcat
5 itself. These classes and resources are TOTALLY
invisible to web applications. All unpacked classes
and resources in $CATALINA_HOME/server/classes, as
well as classes and resources in JAR files under
$CATALINA_HOME/server/lib, are made visible through
this class loader.
aka_sergio
--- Steve Procter <sp...@sanasecurity.com> wrote:
> Authentication uses a database to store user
> information, and the
> database is accessed via an object mapping package.
>
> --Steven
>
> parviz wrote:
> > I'm a little confused as to what you mean by
> object repository.
> > You have your Realm in common/lib which is fine.
> All the other
> > Realm(jdbc,jndi...) exist in common/lib. I'm not
> clear what your Realm
> > does with your object repository? whats the
> connection between these
> > two?Does your compiled jsp files exist in that
> directory as well?
> >
> > I'll try to setup something similar to your setup
> and see if I can come
> > up with any solution unless someone has any by
> now.
> >
> > Parviz
> >
> > On Mon, 2004-11-29 at 15:32, Steve Procter wrote:
> >
> >>We have a web application that uses jsps. We want
> to deliver the
> >>application to the customer without source for the
> jsps. We have done
> >>this in the past by putting all of the compiled
> jsps into a jar file.
> >>
> >>Recently we had to move the application jar files
> from
> >>webapps/appname/WEB-INF/lib to common/lib because
> we implemented our own
> >>realm which uses our object repository; since it
> has to be installed in
> >>server/lib, the code for the repository cannot be
> installed under the
> >>web application directory.
> >>
> >>When the application is installed in common/lib it
> is not able to load
> >>the compiled jsp files. They are installed in
> common/lib/.
> >>
> >>Does anyone have an idea about why these classes
> are not visible?
> >>
> >>Thanks,
> >>
> >>--Steven
> >>
> >>
>
>>---------------------------------------------------------------------
> >>To unsubscribe, e-mail:
> tomcat-user-unsubscribe@jakarta.apache.org
> >>For additional commands, e-mail:
> tomcat-user-help@jakarta.apache.org
> >>
> >>
> >
> >
> >
> >
>
---------------------------------------------------------------------
> > To unsubscribe, e-mail:
> tomcat-user-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail:
> tomcat-user-help@jakarta.apache.org
> >
>
>
>
---------------------------------------------------------------------
> To unsubscribe, e-mail:
> tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail:
> tomcat-user-help@jakarta.apache.org
>
>
__________________________________
Do you Yahoo!?
Yahoo! Mail - Helps protect you from nasty viruses.
http://promotions.yahoo.com/new_mail
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by Steve Procter <sp...@sanasecurity.com>.
Authentication uses a database to store user information, and the
database is accessed via an object mapping package.
--Steven
parviz wrote:
> I'm a little confused as to what you mean by object repository.
> You have your Realm in common/lib which is fine. All the other
> Realm(jdbc,jndi...) exist in common/lib. I'm not clear what your Realm
> does with your object repository? whats the connection between these
> two?Does your compiled jsp files exist in that directory as well?
>
> I'll try to setup something similar to your setup and see if I can come
> up with any solution unless someone has any by now.
>
> Parviz
>
> On Mon, 2004-11-29 at 15:32, Steve Procter wrote:
>
>>We have a web application that uses jsps. We want to deliver the
>>application to the customer without source for the jsps. We have done
>>this in the past by putting all of the compiled jsps into a jar file.
>>
>>Recently we had to move the application jar files from
>>webapps/appname/WEB-INF/lib to common/lib because we implemented our own
>>realm which uses our object repository; since it has to be installed in
>>server/lib, the code for the repository cannot be installed under the
>>web application directory.
>>
>>When the application is installed in common/lib it is not able to load
>>the compiled jsp files. They are installed in common/lib/.
>>
>>Does anyone have an idea about why these classes are not visible?
>>
>>Thanks,
>>
>>--Steven
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>>
>>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by parviz <de...@nikasolutions.net>.
I'm a little confused as to what you mean by object repository.
You have your Realm in common/lib which is fine. All the other
Realm(jdbc,jndi...) exist in common/lib. I'm not clear what your Realm
does with your object repository? whats the connection between these
two?Does your compiled jsp files exist in that directory as well?
I'll try to setup something similar to your setup and see if I can come
up with any solution unless someone has any by now.
Parviz
On Mon, 2004-11-29 at 15:32, Steve Procter wrote:
> We have a web application that uses jsps. We want to deliver the
> application to the customer without source for the jsps. We have done
> this in the past by putting all of the compiled jsps into a jar file.
>
> Recently we had to move the application jar files from
> webapps/appname/WEB-INF/lib to common/lib because we implemented our own
> realm which uses our object repository; since it has to be installed in
> server/lib, the code for the repository cannot be installed under the
> web application directory.
>
> When the application is installed in common/lib it is not able to load
> the compiled jsp files. They are installed in common/lib/.
>
> Does anyone have an idea about why these classes are not visible?
>
> Thanks,
>
> --Steven
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by David Stevenson <ds...@rochester.rr.com>.
When Tomcat receives a request for .jsp page, isn't the first order of
business to compare the date of the .jsp page against the .java file in
the working directory, so Tomcat knows whether to re-translate and
compile the .jsp page?
It would seem that if a web page request comes in for a .jsp page,
Tomcat would have no file to compare the date against in your scheme of
putting the compiled .jsp page in a .jar file only.
David Stevenson
On Tue, 2004-11-30 at 12:08, Steve Procter wrote:
> Sorry if this wasn't clear; the source code is not delivered. It is the
> compiled jsp files which are placed into the jar file.
>
> --Steven
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by Steve Procter <sp...@sanasecurity.com>.
Sorry if this wasn't clear; the source code is not delivered. It is the
compiled jsp files which are placed into the jar file.
--Steven
Quinton Delpeche wrote:
> On Tuesday 30 November 2004 01:32, Steve Procter wrote:
>
>>We have a web application that uses jsps. We want to deliver the
>>application to the customer without source for the jsps. We have done
>>this in the past by putting all of the compiled jsps into a jar file.
>
>
> Hi,
>
> Hate to burst your bubble, but because you put it in a jar file doesn't mean
> that the source is protected.
>
> JAR files can be opened with WinZIP, tar, and jar.
>
> Jar files are merely convenient ways of storing/distributing/installing Java
> code and packages.
>
>
>>Recently we had to move the application jar files from
>>webapps/appname/WEB-INF/lib to common/lib because we implemented our own
>>realm which uses our object repository; since it has to be installed in
>>server/lib, the code for the repository cannot be installed under the
>>web application directory.
>>
>>When the application is installed in common/lib it is not able to load
>>the compiled jsp files. They are installed in common/lib/.
>>
>>Does anyone have an idea about why these classes are not visible?
>
>
> My suggestion is to rather move your functionality into Java classes and use
> the JSP pages to present the information to the client.
>
>
>>Thanks,
>>
>>--Steven
>
> Q
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: Delivering JSPs without source
Posted by Quinton Delpeche <qu...@vippayroll.co.za>.
On Tuesday 30 November 2004 01:32, Steve Procter wrote:
> We have a web application that uses jsps. We want to deliver the
> application to the customer without source for the jsps. We have done
> this in the past by putting all of the compiled jsps into a jar file.
Hi,
Hate to burst your bubble, but because you put it in a jar file doesn't mean
that the source is protected.
JAR files can be opened with WinZIP, tar, and jar.
Jar files are merely convenient ways of storing/distributing/installing Java
code and packages.
> Recently we had to move the application jar files from
> webapps/appname/WEB-INF/lib to common/lib because we implemented our own
> realm which uses our object repository; since it has to be installed in
> server/lib, the code for the repository cannot be installed under the
> web application directory.
>
> When the application is installed in common/lib it is not able to load
> the compiled jsp files. They are installed in common/lib/.
>
> Does anyone have an idea about why these classes are not visible?
My suggestion is to rather move your functionality into Java classes and use
the JSP pages to present the information to the client.
> Thanks,
>
> --Steven
Q
--
Quinton Delpeche
Internal Systems Developer
Softline VIP
Telephone: +27 12 420 7000
Direct: +27 12 420 7007
Facsimile: +27 12 420 7344
http://www.vippayroll.co.za/
Man is the best computer we can put aboard a spacecraft ... and the
only one that can be mass produced with unskilled labor.
-- Wernher von Braun