[MODERATE EMAIL] Proposal to use Servlet annotations for configuration.

[Deepak Dixit-3]

Hi Yash,

Your email has been moderated,
Please subscribe to mailing list

http://ofbiz.apache.org/mailing-lists.html


Thanks & Regards
--
Deepak Dixit
www.hotwaxsystems.com
www.hotwax.co


---------- Forwarded message ----------
From: Pradhan Yash Sharma <[hidden email]>
To: [hidden email]
Cc: Yash Sharma <[hidden email]>
Bcc:
Date: Sun, 17 Sep 2017 15:52:51 +0530
Subject: Proposal to use Servlet annotations for configuration.
Hello All,

I would like to propose to use annotations for configuring Servlets. We
have declared web.xml file in every webapp to modularize code. I would like
to use Web Servlet annotations
<http://docs.oracle.com/javaee/6/api/javax/servlet/annotation/package-summary.html>
to
configure:

1) context params
2) filters
3) listeners
4) servlet
5) session configurations

Please let me know your thoughts.

[Jacques Le Roux]

Hi Pradhan,

Could you give us a quick example of what you want to do with it exactly?

Actually more to the point, what advantages this gives to us?

TIA

Jacques


Le 18/09/2017 à 07:19, Deepak Dixit a écrit :

> Hi Yash,
>
> Your email has been moderated,
> Please subscribe to mailing list
>
> http://ofbiz.apache.org/mailing-lists.html
>
>
> Thanks & Regards
> --
> Deepak Dixit
> www.hotwaxsystems.com
> www.hotwax.co
>
>
> ---------- Forwarded message ----------
> From: Pradhan Yash Sharma <[hidden email]>
> To: [hidden email]
> Cc: Yash Sharma <[hidden email]>
> Bcc:
> Date: Sun, 17 Sep 2017 15:52:51 +0530
> Subject: Proposal to use Servlet annotations for configuration.
> Hello All,
>
> I would like to propose to use annotations for configuring Servlets. We
> have declared web.xml file in every webapp to modularize code. I would like
> to use Web Servlet annotations
> <http://docs.oracle.com/javaee/6/api/javax/servlet/annotation/package-summary.html>
> to
> configure:
>
> 1) context params
> 2) filters
> 3) listeners
> 4) servlet
> 5) session configurations
>
> Please let me know your thoughts.
>

[Yash Sharma]

Hello Jacques,

First of all, thank you for your response, while we declare Servlet
definition in web.xml file we can also do it the java file itself.
Here is an example of declaring a Servlet through annotation:

@WebServlet(name = "/mypluginweb/WelcomeServlet", urlPatterns =
"/mypluginweb/WelcomeServlet", loadOnStartup = 1, description = "Welcome
Servlet")

and for Filters:

@WebFilter(filterName = "MyFilter", displayName = "MyFilter", initParams =
@WebInitParam(name = "allowedPaths", value =
"/error:/control:/select:/index.html:/index.jsp:/default.html:/default.jsp:/images"),
@WebInitParam(name = "redirectPath", value = "/control/main"))

Web components are configurable through annotations it reduces ceremony of
1) Writing XML files
2) Validating and storing Document
3) And finally converting them into Java objects.
4) Annotations based configuration is concise in comparison to XML based
configuration.



On Mon, Sep 18, 2017 at 12:27 PM Jacques Le Roux <
[hidden email]> wrote:

> Hi Pradhan,
>
> Could you give us a quick example of what you want to do with it exactly?
>
> Actually more to the point, what advantages this gives to us?
>
> TIA
>
> Jacques
>
>
> Le 18/09/2017 à 07:19, Deepak Dixit a écrit :
> > Hi Yash,
> >
> > Your email has been moderated,
> > Please subscribe to mailing list
> >
> > http://ofbiz.apache.org/mailing-lists.html
> >
> >
> > Thanks & Regards
> > --
> > Deepak Dixit
> > www.hotwaxsystems.com
> > www.hotwax.co
> >
> >
> > ---------- Forwarded message ----------
> > From: Pradhan Yash Sharma <[hidden email]>
> > To: [hidden email]
> > Cc: Yash Sharma <[hidden email]>
> > Bcc:
> > Date: Sun, 17 Sep 2017 15:52:51 +0530
> > Subject: Proposal to use Servlet annotations for configuration.
> > Hello All,
> >
> > I would like to propose to use annotations for configuring Servlets. We
> > have declared web.xml file in every webapp to modularize code. I would
> like
> > to use Web Servlet annotations
> > <
> http://docs.oracle.com/javaee/6/api/javax/servlet/annotation/package-summary.html
> >
> > to
> > configure:
> >
> > 1) context params
> > 2) filters
> > 3) listeners
> > 4) servlet
> > 5) session configurations
> >
> > Please let me know your thoughts.
> >
>
> --

Thanks,
*Pradhan Yash Sharma*

[Jacques Le Roux]

Thanks Yash,

For me it's interesting only if we can factorise things.
I mean the web.xml files are easy to read but if we can centralise repeating things it's better.
And then the web.xml files will be even easier to read (less stuff).

Fortunately we can factorise

<filter-class>org.apache.ofbiz.webapp.control.ControlFilter</filter-class>

and

<filter-class>org.apache.ofbiz.webapp.control.ContextFilter</filter-class>

and certainly more things using @WebInitParam and @WebInitParam

So this would make the web.xml files much simpler and I agree it's a good thing!

Jacques


Le 23/09/2017 à 14:31, Yash Sharma a écrit :

> Hello Jacques,
>
> First of all, thank you for your response, while we declare Servlet
> definition in web.xml file we can also do it the java file itself.
> Here is an example of declaring a Servlet through annotation:
>
> @WebServlet(name = "/mypluginweb/WelcomeServlet", urlPatterns =
> "/mypluginweb/WelcomeServlet", loadOnStartup = 1, description = "Welcome
> Servlet")
>
> and for Filters:
>
> @WebFilter(filterName = "MyFilter", displayName = "MyFilter", initParams =
> @WebInitParam(name = "allowedPaths", value =
> "/error:/control:/select:/index.html:/index.jsp:/default.html:/default.jsp:/images"),
> @WebInitParam(name = "redirectPath", value = "/control/main"))
>
> Web components are configurable through annotations it reduces ceremony of
> 1) Writing XML files
> 2) Validating and storing Document
> 3) And finally converting them into Java objects.
> 4) Annotations based configuration is concise in comparison to XML based
> configuration.
>
>
>
> On Mon, Sep 18, 2017 at 12:27 PM Jacques Le Roux <
> [hidden email]> wrote:
>
>> Hi Pradhan,
>>
>> Could you give us a quick example of what you want to do with it exactly?
>>
>> Actually more to the point, what advantages this gives to us?
>>
>> TIA
>>
>> Jacques
>>
>>
>> Le 18/09/2017 à 07:19, Deepak Dixit a écrit :
>>> Hi Yash,
>>>
>>> Your email has been moderated,
>>> Please subscribe to mailing list
>>>
>>> http://ofbiz.apache.org/mailing-lists.html
>>>
>>>
>>> Thanks & Regards
>>> --
>>> Deepak Dixit
>>> www.hotwaxsystems.com
>>> www.hotwax.co
>>>
>>>
>>> ---------- Forwarded message ----------
>>> From: Pradhan Yash Sharma <[hidden email]>
>>> To: [hidden email]
>>> Cc: Yash Sharma <[hidden email]>
>>> Bcc:
>>> Date: Sun, 17 Sep 2017 15:52:51 +0530
>>> Subject: Proposal to use Servlet annotations for configuration.
>>> Hello All,
>>>
>>> I would like to propose to use annotations for configuring Servlets. We
>>> have declared web.xml file in every webapp to modularize code. I would
>> like
>>> to use Web Servlet annotations
>>> <
>> http://docs.oracle.com/javaee/6/api/javax/servlet/annotation/package-summary.html
>>> to
>>> configure:
>>>
>>> 1) context params
>>> 2) filters
>>> 3) listeners
>>> 4) servlet
>>> 5) session configurations
>>>
>>> Please let me know your thoughts.
>>>
>> --
> Thanks,
> *Pradhan Yash Sharma*
>

[Jacques Le Roux]

Hi Yash, All,

I also tried to factorise as much things as possible in the past regarding HTTP headers and cookies for security.

It worked for most part but at r1719762 I failed with <cookie-config> in <session-config> and we finally ended with OFBIZ-6655 which is good, but
duplicates things everywhere in web.xml files

I have created 2 patches (trunk and plugin) for that in OFBIZ-6655. It programmatically replaces the web.xml declarations and uses the @WebListener
annotation to start the process.

Jacques

Le 24/09/2017 à 10:27, Jacques Le Roux a écrit :

> Thanks Yash,
>
> For me it's interesting only if we can factorise things.
> I mean the web.xml files are easy to read but if we can centralise repeating things it's better.
> And then the web.xml files will be even easier to read (less stuff).
>
> Fortunately we can factorise
>
> <filter-class>org.apache.ofbiz.webapp.control.ControlFilter</filter-class>
>
> and
>
> <filter-class>org.apache.ofbiz.webapp.control.ContextFilter</filter-class>
>
> and certainly more things using @WebInitParam and @WebInitParam
>
> So this would make the web.xml files much simpler and I agree it's a good thing!
>
> Jacques
>
>
> Le 23/09/2017 à 14:31, Yash Sharma a écrit :
>> Hello Jacques,
>>
>> First of all, thank you for your response, while we declare Servlet
>> definition in web.xml file we can also do it the java file itself.
>> Here is an example of declaring a Servlet through annotation:
>>
>> @WebServlet(name = "/mypluginweb/WelcomeServlet", urlPatterns =
>> "/mypluginweb/WelcomeServlet", loadOnStartup = 1, description = "Welcome
>> Servlet")
>>
>> and for Filters:
>>
>> @WebFilter(filterName = "MyFilter", displayName = "MyFilter", initParams =
>> @WebInitParam(name = "allowedPaths", value =
>> "/error:/control:/select:/index.html:/index.jsp:/default.html:/default.jsp:/images"),
>> @WebInitParam(name = "redirectPath", value = "/control/main"))
>>
>> Web components are configurable through annotations it reduces ceremony of
>> 1) Writing XML files
>> 2) Validating and storing Document
>> 3) And finally converting them into Java objects.
>> 4) Annotations based configuration is concise in comparison to XML based
>> configuration.
>>
>>
>>
>> On Mon, Sep 18, 2017 at 12:27 PM Jacques Le Roux <
>> [hidden email]> wrote:
>>
>>> Hi Pradhan,
>>>
>>> Could you give us a quick example of what you want to do with it exactly?
>>>
>>> Actually more to the point, what advantages this gives to us?
>>>
>>> TIA
>>>
>>> Jacques
>>>
>>>
>>> Le 18/09/2017 à 07:19, Deepak Dixit a écrit :
>>>> Hi Yash,
>>>>
>>>> Your email has been moderated,
>>>> Please subscribe to mailing list
>>>>
>>>> http://ofbiz.apache.org/mailing-lists.html
>>>>
>>>>
>>>> Thanks & Regards
>>>> --
>>>> Deepak Dixit
>>>> www.hotwaxsystems.com
>>>> www.hotwax.co
>>>>
>>>>
>>>> ---------- Forwarded message ----------
>>>> From: Pradhan Yash Sharma <[hidden email]>
>>>> To: [hidden email]
>>>> Cc: Yash Sharma <[hidden email]>
>>>> Bcc:
>>>> Date: Sun, 17 Sep 2017 15:52:51 +0530
>>>> Subject: Proposal to use Servlet annotations for configuration.
>>>> Hello All,
>>>>
>>>> I would like to propose to use annotations for configuring Servlets. We
>>>> have declared web.xml file in every webapp to modularize code. I would
>>> like
>>>> to use Web Servlet annotations
>>>> <
>>> http://docs.oracle.com/javaee/6/api/javax/servlet/annotation/package-summary.html
>>>> to
>>>> configure:
>>>>
>>>> 1) context params
>>>> 2) filters
>>>> 3) listeners
>>>> 4) servlet
>>>> 5) session configurations
>>>>
>>>> Please let me know your thoughts.
>>>>
>>> --
>> Thanks,
>> *Pradhan Yash Sharma*
>>
>
>

[Jacques Le Roux]

Le 24/09/2017 à 10:27, Jacques Le Roux a écrit :
> and certainly more things using @WebInitParam and @WebInitParam
Not sure what I wanted to add there :D

Jacques

[Yash Sharma]

Thank you, Jacques.
We can even take it further with @*WebInitParam *annotation to
initialize values once it for all for all webapps and @*ServletSecurity *for
basic servlet security.

On Tue, Sep 26, 2017 at 2:23 PM Jacques Le Roux <
[hidden email]> wrote:

> Le 24/09/2017 à 10:27, Jacques Le Roux a écrit :
> > and certainly more things using @WebInitParam and @WebInitParam
> Not sure what I wanted to add there :D
>
> Jacques
>
> --
Thanks,
*Pradhan Yash Sharma*

[Jacques Le Roux]

Hi Yash,

It's not what I wanted to put there :)

But anyway, since I can't remember, after a quick look I have no real ideas on how you will use @ServletSecurity (I guess with @HttpConstraint
and@HttpMethodConstrain).

So please feel free to provide patches in Jiras to continue your ideas

Thanks

Jacques


Le 26/09/2017 à 13:42, Yash Sharma a écrit :

> Thank you, Jacques.
> We can even take it further with @*WebInitParam *annotation to
> initialize values once it for all for all webapps and @*ServletSecurity *for
> basic servlet security.
>
> On Tue, Sep 26, 2017 at 2:23 PM Jacques Le Roux <
> [hidden email]> wrote:
>
>> Le 24/09/2017 à 10:27, Jacques Le Roux a écrit :
>>> and certainly more things using @WebInitParam and @WebInitParam
>> Not sure what I wanted to add there :D
>>
>> Jacques
>>
>> --
> Thanks,
> *Pradhan Yash Sharma*
>

[Jacques Le Roux]

Ah Pradhan,

Note that I have already a number of HTTP headers securing in RequestHandler . But I'd not be against using stuff we have now in Tomcat 8.5

https://tomcat.apache.org/tomcat-8.5-doc/config/filter.html#HTTP_Header_Security_Filter/Initialisation_parameters

And of course also CORS Filter, CSRF Prevention Filter, etc.

Please refer to

https://issues.apache.org/jira/browse/OFBIZ-6766

https://issues.apache.org/jira/browse/OFBIZ-6759

https://cwiki.apache.org/confluence/display/OFBIZ/How+to+Secure+HTTP+Headers

for a better communication :)

Thanks

Jacques


Le 26/09/2017 à 15:47, Jacques Le Roux a écrit :

> Hi Yash,
>
> It's not what I wanted to put there :)
>
> But anyway, since I can't remember, after a quick look I have no real ideas on how you will use @ServletSecurity (I guess with @HttpConstraint
> and@HttpMethodConstrain).
>
> So please feel free to provide patches in Jiras to continue your ideas
>
> Thanks
>
> Jacques
>
>
> Le 26/09/2017 à 13:42, Yash Sharma a écrit :
>> Thank you, Jacques.
>> We can even take it further with @*WebInitParam *annotation to
>> initialize values once it for all for all webapps and @*ServletSecurity *for
>> basic servlet security.
>>
>> On Tue, Sep 26, 2017 at 2:23 PM Jacques Le Roux <
>> [hidden email]> wrote:
>>
>>> Le 24/09/2017 à 10:27, Jacques Le Roux a écrit :
>>>> and certainly more things using @WebInitParam and @WebInitParam
>>> Not sure what I wanted to add there :D
>>>
>>> Jacques
>>>
>>> --
>> Thanks,
>> *Pradhan Yash Sharma*
>>
>
>

[Jacques Le Roux]

Le 26/09/2017 à 16:16, Jacques Le Roux a écrit :
> Note that I have already a number of HTTP headers securing in RequestHandler .
This is what happens when I rewrite sentences, I meant:

Note that I have already secured a number of HTTP headers in RequestHandler .

Jacques