Re: vote please + thoughts about Welcome and Error

[Bernd Eilers <be...@stardivision.de>]

Hi there !

> i think we need to vote on this one as arun is basically
> blocked.
>

I vote:

+1 for 404 - not found.
-1 for 403 - forbidden.

1.) 403 forbidden on directories could be handled by some general 
access control mechanism in the Web Server

2) Might be nice to add a method for letting the user customize what 
to do with a request on /servlet or /WEB-INF/*, If he didn't customize 
anything it's a  404 - not found answer. A 403 reply blocks future 
enhancements in this area.

2.1.) Use an index.jsp file if configured in the <welcome-file-list> and 
found in the location.

2.2.) Would be nice if the Tomcat User could add a custom Welcome 
Servlet that would answer requests on /servlet or /WEB-INF/* in the 
future. That one could return a list of available servlets or a 403 
for forbidden. A Welcome Servlet might be nicer in some other areas 
too than just welcome files, for example in a combined WEB (HTML) + 
WAP (WML) Server.

2.3.) Would be nice if the Tomcat User could configure an optional 404 
error handler servlet for everything that is not handled by an 
servlet, JSP or Web Page. The User should be encouraged to reply with 
404 or 403 errors in this servlet on it's own decision (e.g. depending 
on the Request-URL or some Authorisation ), but the error handler 
servlet may add something like a search engine frontend in the Reply. 
If Error Handling will be supported a Servlet is better than something 
like a 404.html file because the servers purpose doesn't necessarily 
have to be serving text/html. 


By the way:

Where is the <welcome-file-list> in web.xml specified ?

> Craig

Bernd

Re: vote please + thoughts about Welcome and Error

[James Todd <ja...@eng.sun.com>]

good points.

for this time i think we should go with 404 for test
purposes and see what changed to start emitting 403.

i believe the capability to specify error pages (eg
404.html) is available at some level in the web.xml
but i'm not sure it will completely address your goals.
this is based on some cursory thoughts while reading
servlet 2.2 without excercising this specific goal at
any level. it would be nice to get the html code out
of tomcat.

the default welcome files are specified in:

	org.apache.tomcat.deployment.web.xml

and will be obviated (vs aggregated) by any context
specified (ie WEB-INF/web.xml) welcome files. this
later logic occurs in:

	org.apache.tomcat.core.Context.init()

which i've considered factoring out as a utility
class to keep Context (the keeper of lots of info)
lean'n mean.

hope this helps,

- james

Bernd Eilers wrote:
> 
> Hi there !
> 
> > i think we need to vote on this one as arun is basically
> > blocked.
> >
> 
> I vote:
> 
> +1 for 404 - not found.
> -1 for 403 - forbidden.
> 
> 1.) 403 forbidden on directories could be handled by some general
> access control mechanism in the Web Server
> 
> 2) Might be nice to add a method for letting the user customize what
> to do with a request on /servlet or /WEB-INF/*, If he didn't customize
> anything it's a  404 - not found answer. A 403 reply blocks future
> enhancements in this area.
> 
> 2.1.) Use an index.jsp file if configured in the <welcome-file-list> and
> found in the location.
> 
> 2.2.) Would be nice if the Tomcat User could add a custom Welcome
> Servlet that would answer requests on /servlet or /WEB-INF/* in the
> future. That one could return a list of available servlets or a 403
> for forbidden. A Welcome Servlet might be nicer in some other areas
> too than just welcome files, for example in a combined WEB (HTML) +
> WAP (WML) Server.
> 
> 2.3.) Would be nice if the Tomcat User could configure an optional 404
> error handler servlet for everything that is not handled by an
> servlet, JSP or Web Page. The User should be encouraged to reply with
> 404 or 403 errors in this servlet on it's own decision (e.g. depending
> on the Request-URL or some Authorisation ), but the error handler
> servlet may add something like a search engine frontend in the Reply.
> If Error Handling will be supported a Servlet is better than something
> like a 404.html file because the servers purpose doesn't necessarily
> have to be serving text/html.
> 
> By the way:
> 
> Where is the <welcome-file-list> in web.xml specified ?
> 
> > Craig
> 
> Bernd
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org