You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Leo Donahue - RDSA IT <Le...@mail.maricopa.gov> on 2013/07/11 00:08:12 UTC
[OT] WEB-INF
When did it start that developers decided to place jsps in the WEB-INF directory? Was that intended from the beginning, or was it stumbled upon?
Leo
Re: [OT] WEB-INF
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
André,
On 7/11/13 11:36 AM, André Warnier wrote:
> Leo Donahue - RDSA IT wrote:
>>> -----Original Message----- From: Tim Funk
>>> [mailto:funkman@apache.org] Subject: Re: [OT] WEB-INF
>>>
>>> Its a best practice to keep your jsp's inside of WEB-INF.
>>> Since WEB-INF/ is not allowed to be requested by the browser -
>>> its a simple enforcement mechanism to prevent users from direct
>>> access to calling jsps.
>>
>> Thanks Tim. A lot of old reference books on servlets/JSP never
>> really touched on this topic, and I've read about placing
>> resources in WEB-INF on the web somewhere since then. I was
>> curious if this practice was originally by design or if the
>> benefit was realized after the servlet spec - such as someone
>> deciding "hey, we should put stuff in WEB-INF".
>>
>>
>>> (Since it may be common to have jsp's as snippets for header
>>> / footers etc -- and there for they might be able to be called
>>> in surprising ways and exposing funny attacks)
>>
>> You mention header/footers, which was in the back of my mind when
>> I posted this. Placing headers/footers in WEB-INF doesn't allow
>> me to re-use these in different webapps, without having multiple
>> copies of these? If I have a header/footer template in
>> \webapps\ROOT\WEB-INF\templates\, I can't reference it from
>> \webapps\App2\WEB-INF\templates ... or can I?
>>
>
> There are 2 schools of thought here. One says that webapps should
> be independent of one another. On that base, you /should/ duplicate
> these headers/footers for each webapp, so that they can still be
> individually modified/redeployed. And one could argue that they are
> probably not so big (bytewise), so the additional space required
> should not be a real inconvenient. The other school of thought
> would argue that have multiple redundant copies of something is
> bad, because it can lead to diverging versions etc. (And the first
> school of thought would then come back with a vengeance, saying
> that this is an issue which your deployment process should take
> care of).
For the record, I personally am an instructor at this particular
School of Thought (solve duplication issues with deployment processes).
Here's why: your web application(s) will become overly complicated and
fragile if you try to share resources between webapps. Fragility is
IMO more expensive than the maintenance cost of a more complicated build.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJR4AZCAAoJEBzwKT+lPKRYInsP/0qPu/Yuk1Olh3bcrg5/4pIQ
dl4d8q6pKHZusPzGp2d27fb7grMXXUXCXvx8qe+uswNxslSXKaqIAdtd8lYGz7b5
ppPYBsSm648DzPJ4hX2JAEk8bc1GE19nl6e702lWH0SMceFxEnxqu56XAI57DPQa
9LwUrmjPsIiw213O4S/Mc8HQcBw4FpTMx9zP1G/iW+QLNA9k+4OFjuqNN6A+56oc
Tfxu3TFrgcMUv7ag7C0WEq6Pkayfz8aEcpmD/QyW4CD/UnvFSj9+XBeKOdSUhK8d
tn9p62RPp8uH8AxAKnvWwtKmn8aSyGzCNGrJrLfiyZjVeMJ4LiGhsFYIe5ZNbdWr
InJcn+0ebldbhOGq/ebTXS4/Z0TFFmu3Hs/zKyeJ92ln1dBslUNLuFYWVmhm5e7S
o/RfSWHR6OTJ2Tb3TDhERvEbR5babxZuAlaiCquRAtqlIz4ebFMLES0atD6EPcP0
pPRE5OJytEpi0ZZ0DGjASJlBKAZu9JX1GwqcwHMmRsSYaODH7elGcL+FWRUDrABc
mD5nfeHzHThdjYDt3phhNLaYjw9HxE5vVPxLb0Ga9c4PAr5W1eer3/l1otE/r4RM
aLVCmeXiXGcxdKn6uQGORleXzCszaZbyRWuDAbV1O7elvwopp1olCgrHlnW3SQ8w
od/iQLhZwizoMZeFOeFl
=d390
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] WEB-INF
Posted by Mark Thomas <ma...@apache.org>.
On 15/07/2013 20:09, Andrew Kujtan wrote:
> When you say resource handling are you referring to serving files from
> within a jars' META-INF/resource folder?
Yes, and more. See the Tomcat docs from the CI system for details:
http://ci.apache.org/projects/tomcat/tomcat8/docs/config/resources.html
There was also lots of discussion on the dev list in June - Sept 2012
such as this thread:
http://tomcat.markmail.org/thread/ucgknkeserel44sd
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: [OT] WEB-INF
Posted by Andrew Kujtan <ak...@evertz.com>.
> -----Original Message-----
> From: Mark Thomas [mailto:markt@apache.org]
> Sent: Monday, July 15, 2013 1:46 PM
> To: Tomcat Users List
> Subject: Re: [OT] WEB-INF
>
> On 15/07/2013 17:17, Leo Donahue - RDSA IT wrote:
> >> -----Original Message-----
> >> From: Mark Thomas [mailto:markt@apache.org]
> >> Subject: Re: [OT] WEB-INF
> >>
> >> ...I'd encourage you to grab the 8.0.x source, built it and try out
> the new resource handling. Feedback welcome.
> >
> > From here?
> > http://ci.apache.org/projects/tomcat/tomcat8/docs/building.html
> >
> > The source download link (http://tomcat.apache.org/download-80.cgi )
> says permission denied.
>
> There is no source download yet as there has been no 8.0.x release.
> You'll need to check out /trunk/ from svn as per
> http://tomcat.apache.org/svn.html
>
> Mark
When you say resource handling are you referring to serving files from
within a jars' META-INF/resource folder?
-Andrew
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] WEB-INF
Posted by Mark Thomas <ma...@apache.org>.
On 15/07/2013 17:17, Leo Donahue - RDSA IT wrote:
>> -----Original Message-----
>> From: Mark Thomas [mailto:markt@apache.org]
>> Subject: Re: [OT] WEB-INF
>>
>> ...I'd encourage you to grab the 8.0.x source, built it and try out the new resource handling. Feedback welcome.
>
> From here?
> http://ci.apache.org/projects/tomcat/tomcat8/docs/building.html
>
> The source download link (http://tomcat.apache.org/download-80.cgi ) says permission denied.
There is no source download yet as there has been no 8.0.x release.
You'll need to check out /trunk/ from svn as per
http://tomcat.apache.org/svn.html
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: [OT] WEB-INF
Posted by Leo Donahue - RDSA IT <Le...@mail.maricopa.gov>.
>-----Original Message-----
>From: Mark Thomas [mailto:markt@apache.org]
>Subject: Re: [OT] WEB-INF
>
>...I'd encourage you to grab the 8.0.x source, built it and try out the new resource handling. Feedback welcome.
>From here?
http://ci.apache.org/projects/tomcat/tomcat8/docs/building.html
The source download link (http://tomcat.apache.org/download-80.cgi ) says permission denied.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] WEB-INF
Posted by Mark Thomas <ma...@apache.org>.
On 15/07/2013 15:38, Leo Donahue - RDSA IT wrote:
>> -----Original Message----- From: Mark Thomas
>> [mailto:markt@apache.org] Subject: Re: [OT] WEB-INF
>>
>> I'd prefer to see a clearer requirement for it from the user base
>
> What about a single site with multiple webapps all laid out with the
> same header/footer, left/right navigation styles ? - all static
> content.
That is covered by overlays. Multi-tenancy was a lot wider than that.
> I understand now that the build/deploy process will take care of the
> redundant templates. A change in one header/footer just means I
> redeploy every web app using it - or essentially all of them.
This should be a lot easier to handle with Tomcat 8. If this is a
problem that applies to a site you manage, I'd encourage you to grab the
8.0.x source, built it and try out the new resource handling. Feedback
welcome.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: [OT] WEB-INF
Posted by Leo Donahue - RDSA IT <Le...@mail.maricopa.gov>.
>-----Original Message-----
>From: Mark Thomas [mailto:markt@apache.org]
>Subject: Re: [OT] WEB-INF
>
>I'd prefer to see a clearer requirement for it from the user base
What about a single site with multiple webapps all laid out with the same header/footer, left/right navigation styles ? - all static content.
I understand now that the build/deploy process will take care of the redundant templates. A change in one header/footer just means I redeploy every web app using it - or essentially all of them.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] WEB-INF
Posted by Mark Thomas <ma...@apache.org>.
On 15/07/2013 10:38, Rainer Frey wrote:
>
> On 11.07.2013, at 17:36, André Warnier <aw...@ice-sa.com> wrote:
>
>> Leo Donahue - RDSA IT wrote:
>>> You mention header/footers, which was in the back of my mind when
>>> I posted this. Placing headers/footers in WEB-INF doesn't allow
>>> me to re-use these in different webapps, without having multiple
>>> copies of these? If I have a header/footer template in
>>> \webapps\ROOT\WEB-INF\templates\, I can't reference it from
>>> \webapps\App2\WEB-INF\templates ... or can I?
>>
>> There are 2 schools of thought here. One says that webapps should
>> be independent of one another.
>
> And that's the only "school of thought" that the servlet spec
> supports (for better or worse). At the deployed application stage
> (vs. development) reuse is not supported at all, each web app must be
> self-contained.
There was going to be support for overlays in Servlet 3.1 but that got
dropped as part of dropping anything related to multi-tenancy.
Generally, I think dropping the multi-tenancy stuff was a good idea. I'd
prefer to see a clearer requirement for it from the user base and it is
something I rarely see here and when it is seen there is usually a way
to meet the requirement with existing functionality anyway.
The overlap support would have been useful.
The good news from a user point of view is that I re-wrote the resource
implementation for Tomcat 8 with overlay support in mind. (The bad news
from my point of view is the first piece of Servlet 3.1 functionality I
invested time in was dropped pretty much as I finished the work. Hey ho.)
The new resource implementation is still in Tomcat 8 and should make
sharing content between web applications very simple. Of course, it will
be Tomcat specific.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] WEB-INF
Posted by Rainer Frey <ra...@inxmail.de>.
On 11.07.2013, at 17:36, André Warnier <aw...@ice-sa.com> wrote:
> Leo Donahue - RDSA IT wrote:
>> You mention header/footers, which was in the back of my mind when I posted this. Placing headers/footers in WEB-INF doesn't allow me to re-use these in different webapps, without having multiple copies of these? If I have a header/footer template in \webapps\ROOT\WEB-INF\templates\, I can't reference it from \webapps\App2\WEB-INF\templates ... or can I?
>
> There are 2 schools of thought here.
> One says that webapps should be independent of one another.
And that's the only "school of thought" that the servlet spec supports (for better or worse). At the deployed application stage (vs. development) reuse is not supported at all, each web app must be self-contained.
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] WEB-INF
Posted by André Warnier <aw...@ice-sa.com>.
Leo Donahue - RDSA IT wrote:
>> -----Original Message-----
>> From: Tim Funk [mailto:funkman@apache.org]
>> Subject: Re: [OT] WEB-INF
>>
>> Its a best practice to keep your jsp's inside of WEB-INF. Since WEB-INF/ is not
>> allowed to be requested by the browser - its a simple enforcement
>> mechanism to prevent users from direct access to calling jsps.
>
> Thanks Tim. A lot of old reference books on servlets/JSP never really touched on this topic, and I've read about placing resources in WEB-INF on the web somewhere since then. I was curious if this practice was originally by design or if the benefit was realized after the servlet spec - such as someone deciding "hey, we should put stuff in WEB-INF".
>
>
>> (Since it may be common to have jsp's as snippets for header / footers etc -- and there for
>> they might be able to be called in surprising ways and exposing funny attacks)
>
> You mention header/footers, which was in the back of my mind when I posted this. Placing headers/footers in WEB-INF doesn't allow me to re-use these in different webapps, without having multiple copies of these?
>
> If I have a header/footer template in \webapps\ROOT\WEB-INF\templates\, I can't reference it from \webapps\App2\WEB-INF\templates ... or can I?
>
There are 2 schools of thought here.
One says that webapps should be independent of one another. On that base, you /should/
duplicate these headers/footers for each webapp, so that they can still be individually
modified/redeployed. And one could argue that they are probably not so big (bytewise), so
the additional space required should not be a real inconvenient.
The other school of thought would argue that have multiple redundant copies of something
is bad, because it can lead to diverging versions etc.
(And the first school of thought would then come back with a vengeance, saying that this
is an issue which your deployment process should take care of).
You /can/ probably have a single copy, and point to it from several webapps using links
(or aliases ?).
You'll need to be careful when undeploying webapps, that this does not delete more that
what you think (e.g. the things being linked to, from that webapp). As far as I remember,
that used to be an issue some time in past Tomcat versions, but still as far as I
remember, this can now be fixed by some configuration parameter (which unfortunately I do
not remember the name or location of; you may want to re-read this carefully :
https://tomcat.apache.org/tomcat-7.0-doc/config/context.html).
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: [OT] WEB-INF
Posted by Leo Donahue - RDSA IT <Le...@mail.maricopa.gov>.
>-----Original Message-----
>From: Tim Funk [mailto:funkman@apache.org]
>Subject: Re: [OT] WEB-INF
>
>Its a best practice to keep your jsp's inside of WEB-INF. Since WEB-INF/ is not
>allowed to be requested by the browser - its a simple enforcement
>mechanism to prevent users from direct access to calling jsps.
Thanks Tim. A lot of old reference books on servlets/JSP never really touched on this topic, and I've read about placing resources in WEB-INF on the web somewhere since then. I was curious if this practice was originally by design or if the benefit was realized after the servlet spec - such as someone deciding "hey, we should put stuff in WEB-INF".
>(Since it may be common to have jsp's as snippets for header / footers etc -- and there for
>they might be able to be called in surprising ways and exposing funny attacks)
You mention header/footers, which was in the back of my mind when I posted this. Placing headers/footers in WEB-INF doesn't allow me to re-use these in different webapps, without having multiple copies of these?
If I have a header/footer template in \webapps\ROOT\WEB-INF\templates\, I can't reference it from \webapps\App2\WEB-INF\templates ... or can I?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] WEB-INF
Posted by Tim Funk <fu...@apache.org>.
Its a best practice to keep your jsp's inside of WEB-INF. Since WEB-INF/ is
not allowed to be requested by the browser - its a simple enforcement
mechanism to prevent users from direct access to calling jsps. (Since it
may be common to have jsp's as snippets for header / footers etc -- and
there for they might be able to be called in surprising ways and exposing
funny attacks)
On Wed, Jul 10, 2013 at 6:08 PM, Leo Donahue - RDSA IT <
LeoDonahue@mail.maricopa.gov> wrote:
> When did it start that developers decided to place jsps in the WEB-INF
> directory? Was that intended from the beginning, or was it stumbled upon?
>
> Leo
>
>
Re: [OT] WEB-INF
Posted by Tim Watts <ti...@cliftonfarm.org>.
On Wed, 2013-07-10 at 15:08 -0700, Leo Donahue - RDSA IT wrote:
> When did it start that developers decided to place jsps in the WEB-INF
> directory? Was that intended from the beginning, or was it stumbled
> upon?
My guess is that it was a side effect of MVC adoption -- making views
accessible only via a controller.
> Leo
>