URL patterns in web.xml too permissive?

Question

I have a servlet with web.xml as follows:

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns="http://java.sun.com/xml/ns/javaee"
  xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
  xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
  http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" 
  id="WebApp_ID" version="3.0">
  <welcome-file-list>
    <welcome-file>/</welcome-file>
  </welcome-file-list>
  <servlet>
    <servlet-name>myservlet</servlet-name>
    <servlet-class>com.mydomain.myapp.MyServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>myservlet</servlet-name>
    <url-pattern>/</url-pattern>
    <url-pattern>/rest1*</url-pattern>
    <url-pattern>/rest2*</url-pattern>
    <url-pattern>/rest3*</url-pattern>
  </servlet-mapping>
</web-app>

Ultimately, the servlet should support REST calls like GET from http://myserver/myapp/rest1?param=1.

However, what happens is that all invocations of URLs that start with http://myserver/myapp/ from a browser apparently lead to calls to the servlet's doGet() method with request.pathInfo() == null.

But then, with the given url-patterns, should the URL http://myserver/myapp/rest1?param=1 not lead to "/rest1".equals(request.pathInfo()) and should a URL pattern such as http://myserver/myapp/foo not lead to HTTP response 404 from the servlet?

The servlet is running on Apache Tomcat 9.

score 1 · Accepted Answer · edited May 23 '17 at 12:33

1

Changing to these URL patterns proved most effective:

<url-pattern></url-pattern>
<url-pattern>/rest1</url-pattern>
<url-pattern>/rest2</url-pattern>
<url-pattern>/rest3</url-pattern>

The key was changing from / to the empty URL pattern. The difference between the two and other key patterns is nicely explained in this previous answer.

I am now using getServletPath() instead of getPathInfo() for further dispatching inside doGet(). The difference between those and other functions (and why getPathInfo() now always returns null) is nicely explained in that previous answer.

edited May 23 '17 at 12:33

Community

1
1

answered Aug 22 '16 at 14:48

Drux

11,992
13
66
116

Note that this is also explained in the servlet specification. I know more people don't usually read specs because they are dry and unreadable, but the Java Servlet Specification isn't one of those documents: it's quite readable and answers most questions about how things should behave. – Christopher Schultz Aug 23 '16 at 21:42
@ChristopherSchulz Thx for participating in answering as a senior Tomcat expert. BTW, I have just deleted that other recent question about confusion between response codes 401/501. I was being stupid about `curl`'s command line options. Tried with `curl -I` where `curl -i` would have been appropriate. Re-thx. – Drux Aug 23 '16 at 21:47
Yes, using `curl -I` will issue a `HEAD` request. If your servlet doesn't support `doHead`, then you'll get a 501 response. `-i` looks like what you wanted. – Christopher Schultz Aug 23 '16 at 21:50

score 0 · Answer 2 · answered Aug 22 '16 at 05:33

0

change the <url-pattern>/rest1*</url-pattern> to <url-pattern>/rest1/*</url-pattern>

answered Aug 22 '16 at 05:33

kuhajeyan

10,727
10
46
71

URL patterns in web.xml too permissive?

2 Answers2