Problems with servlet filter

[Chad Cook]

I'm using servlet filters for the first time on my current development project and I'm running into a couple of problems.

The first problem I ran into was that certain urls will not hit the filter, while others will. I read online and in these forums and found that it could be because I'm using a dispatch.forward(), whereas the filter looks for requests by default. So I added in the two dispatcher tags to web.xml to specify both the forward and the request. But now when I try to access my web-app I get the following exception on my filter chain:

SEVERE: Servlet.service() for servlet jsp threw exception
java.lang.StackOverflowError
	at javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:216)
	at org.apache.catalina.core.ApplicationHttpRequest.getSession(ApplicationHttpRequest.java:545)
... (repeats about 500 times) ...
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
	at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:630)
	at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:436)
	at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374)
	at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302)
	at com.extremetix.neoadmin.LoginServlet.doFilter(LoginServlet.java:138)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

Does anyone know what I'm doing wrong, or am I wrong in my assumption that I need to adjust the dispatcher in web.xml to ensure the filter snags the missing forwards?

[Bear Bibeault]

No code? No config? How can we even guess?

[Chad Cook]

Erm, telepathy?

Here's my filter setup in web-xml:

 <filter>
  <description>This filter checks that the user is logged in</description>
  <display-name>LoginCheck</display-name>
  <filter-name>LoginCheck</filter-name>
  <filter-class>com.extremetix.neoadmin.LoginServlet</filter-class>
 </filter>
 <filter-mapping>
     <filter-name>LoginCheck</filter-name>
     <url-pattern>*.jsp</url-pattern>
	 <dispatcher>REQUEST</dispatcher>     
	 <dispatcher>FORWARD</dispatcher>
 </filter-mapping>    

[Bosun Bello]

Your mapping has already indicated that he filter should be applied to forwards, so not sure why it's not working. Do these resources that are forwarded to also match the url pattern .jsp?

[Chad Cook]

All of the pages/resources that I am forwarding to are .jsp's.

[Ben Souther]

StackOverflow exceptions are often caused by endless recursion.
What are you doing in your filter?
Are you forwarding to something?
If so, is it possible that you've set up an endless loop by catching the forward with a filter that tries to forward which gets caught again by the filter which tries to forward which gets caught by the filter which tries to forward to something that gets caught by the filter......?

If it's not too long, post the code to your filter.

[Chad Cook]

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
    {
    	try
    	{
	    	// get the session
	    	HttpSession session = ((HttpServletRequest)request).getSession();
	    	// if the session or login credentials are null, the user has not logged in
	    	if(session == null || NeoAdminUtility.retreiveLoginCredentials(session) == null)
	    	{
	    		// send the user back to the index page to log in
	    		if(filterConfig != null)
	    		{
	    			// save the url the user wanted to go to if they were not headed to the index page
	    			String uri = ((HttpServletRequest)request).getRequestURI();
					if(uri.indexOf("/NeoAdmin/") != (uri.length() - ("/NeoAdmin/").length()))
					{
						NeoAdminUtility.saveRequestedURL((HttpServletRequest)request);
					}
    				filterConfig.getServletContext().getRequestDispatcher("/index.jsp").forward(request, response);
    				return;
	    		}
	    	}
	    	// else continue on our way
	    	else
	    	{
				chain.doFilter(request, response);
	    	}
		} catch (IOException ioe)
		{
			ioe.printStackTrace();
    	} catch (ServletException se)
    	{
    		se.printStackTrace();
    	}

    }

I don't think there's an endless forward here, but this is my first time working with servlet filters so I could be missing something.

[Ben Souther]

You've got this filter configured to intercept calls to *.jsp; both for requests and forwards.

In this filter, you have a case in which it will forward to index.jsp.
Why wouldn't this loop endlessly?

[Chad Cook]

Good catch. Is there a way to configure the forward so that it will not catch index.jsp, but everything else? Is this the proper way to attack this?

[Ben Souther]

Chad Cook wrote:Good catch. Is there a way to configure the forward so that it will not catch index.jsp, but everything else? Is this the proper way to attack this?

Not unless you have your index.jsp in a separate directory.
If it were me, I'd take a good look at why I need this filter to catch forwards.
Is there anything else you could map to in your URLs other than *.jsp?

Situations like this are a good example of why Front Controllers make sense.

[Bear Bibeault]

Ben Souther wrote:Situations like this are a good example of why Front Controllers make sense.

Quoted for truth.

[Eddy Pelaic]

Hello,

It's a recursive loop because you filter all the *.jsp included index.jsp.

try <url-pattern>/NeoAdmin/*</url-pattern>

Hope your index.jsp is not inside /NeoAdmin/ directory.

@+
Edo...

[Ben Souther]

Eddy Pelaic wrote:...

try <url-pattern>/NeoAdmin/*</url-pattern>
...

I don't think there is enough information in this thread for us to make suggestions such as this (which is why I didn't make any concrete suggestions).
If there is an image in the NeoAdmin directory that gets used in the index.jsp page the filter would catch it and try to redirect it to the index.jsp with the URL pattern you've suggested.

The original poster needs to take a long look at how he's got his app structured and figure out whether there even is a url-pattern or group of them that would work. If not, he needs to consider restructuring the application so that this can be done.

[Eddy Pelaic]

Hello,

It's right, there is not enough informations, but if the index.jsp is in public "area", it should not use images or resources in secure directories. I consider that's all resources must be in a "resources" folder in public access, and specials critical resources in a subdirectory of secured directory or provided by secure code (filter/servlet/Jsp).
It's better to have a clean separation of public / secure.
The url pattern "*.jsp" works only for JSP's, but not for others extension or servlet's url "/myservlet.1234". So it's more difficult to ensure secure access for all resources with that url-pattern.

In the filter, he can check if the browser want to GET an picture and return a 404 code than forwarding to index page. But it's more complex to do and time consuming of CPU.

 

public void doFilter(ServletRequest request, 
						 ServletResponse response,
						 FilterChain chain) throws IOException, ServletException {
		
		
		HttpServletResponseWrapper res = new HttpServletResponseWrapper( (HttpServletResponse)response );

                if( user not logged){
                        // do forward to index.jsp
                }
                if ( some specific resources ){
                         res.setStatus( 404 ); // or custom code
                }
                else {
                         chain.doFilter( request, response );
                }

}

 

I did that for Flex UI HTTP/XML and Ajax request to not have the login page content in the response, because the forward send a 200 status code and it's simpler to handle status code than check the content of page.

@+
Edo...

[Ben Souther]

Eddy Pelaic wrote:... I consider that's all resources must be in a "resources" folder in public access, and specials critical resources in a subdirectory of secured directory or provided by secure code (filter/servlet/Jsp).

Another assumption that I wouldn't be prepared to make.
Again, if this were my project, I would take a good look at how things are organized and then determine whether there is a url-pattern (or group of them) that will work OR whether I need to restructure the app (possibly adding a front controller) to make it possible to do this cleanly.

[Eddy Pelaic]

Hello,

this problem could be a good question for SCWCD exam, Chad now knows why he get a StackOverflowException => infinite recursion and and how to fix it => web app structure / url-pattern.

I assumed with "*.jsp" url-pattern, that Chad's application is a "direct access to JSP's" based web app. For the Front controller pattern it's another topic, why only use Servlet's and Jsp's ?

@+
Edo.