Accessing one web application from another.

[Dmitri Cherkas]

Hello,

if i have the following two very simple web applications running on the same server :

1) the FIRST is : \tomcat\webapps\FIRST\WEB-INF\classes\test\FirstForAccessTheSecond.class

2) the SECOND is :
\tomcat\webapps\SECOND\index.html
\tomcat\webapps\SECOND\folder1\folder1.jsp

the questions are :
Can the "FirstForAccessTheSecond.class" of the FIRST application access the "index.html" file of the SECOND application to modify it ?
Can the "FirstForAccessTheSecond.class" of the FIRST application delete the "folder1" of the SECOND application ?

If no - why ? Can you indicate where J2EE specification specify it ?

Thank you in advance,
Dmitri.

[Frits Walraven]

Hi Dmitri,

A RequestDispatcher from the ServletContext of web-application A can get to the ServletContext of web-application B as long as A and B are located in the same JVM (web-container) and the web-container allows it. By default, for instance, Tomcat doesn't allow this (security risk). You can change this setting in the server.xml or config.xml: <Context crossContext="true">

In web-application A you can read a file from web-application B by calling getResourceAsStream() on the ServletContext of B:

// in web-app A
ServletContext context = getServletContext.getContext(String uripath); // read context of B
InputStream is = context.getResourceAsStream(String path)         // get file from B

You can't modify or delete this file though. (because there is nowhere in the specs, that specifies that you can do that .....)

Regards,
Frits

[Dmitri Cherkas]

Hi Frits,

thank you very much for the competent response with the clear example !

Only one observation...

You can't modify or delete this file though. (because there is nowhere in the specs, that specifies that you can do that .....)

the contrary of your note, though, is true : if specs doesn't specify explicitly that you can't do something you CAN do that thing. Therefore if the specs doesn't say that you cann't delete the file in another webapplication, in theory, you CAN do it. I think that, in this case, the implementation of the webcontainer (Tomcat) can allow or disallow it.

Have a nice weekend !
Dmitri.

[Frits Walraven]

Hi Dmitri,

the contrary of your note, though, is true : if specs doesn't specify explicitly that you can't do something you CAN do that thing.

It really depends, but we are here on the certification forum. During the exam you will only be questioned of what is specified.
Furthermore if something is not specified and it is, for instance, possible in Tomcat your code for sure won't be portable to another web-container. Therefore not recommendable.

Apart from that: if you look closely at the API you will find a context.getResourceAsStream(String path), but nowhere a setResourceAsStream(String path) .

Regards and have a nice weekend too !

Frits