Why I can't "directly" call Servlet from HTML?

Question

As a beginner in JSP and Servlets, I learned two ways to call my Servlet from HTML file. One is using servlet annotation, and another one is using XML's mapping configuration. Pardon my ignorance, but why can't I simply write the name of Servlet inside form's action attribute? What is happening behind the "curton" that forces us developers to pay special attention to Servlets? Unlike HTML and JSP files which we can call directly.

This is what I am talking about. Or, why simply doing this is not correct:

index.html:

<html><body>
    <form action="MyServlet" method="POST">
        Enter name: <input type="text" name="name">
        <button>Submit name</button>
    </form>
</body></html>

MyServlet.java:

public class MyServlet extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        PrintWriter pw = resp.getWriter();
        String input = req.getParameter("name");
        pw.println("hello " + input);
    }
}

I understanding mapping servlets provides us flexibility and security. But my question still stands. Why "direct calling" Servlet class file is not available and gives 404 error not found? Why server can't find my servlet?

The server needs to know which URL goes to which servlet. That's why you need to declare it either by adding the @WebServlet annotation or in the web.xml. Else how to know in which package it has to look for servlet ? What if there are 2 classes having the same name in 2 different packages ? That's why you need the mapping — Zinc, Dec 13 '20 at 07:50
This was possible once in a previous century then it was found it's a huge security vulrenability so it's not possible anymore. See abovelinked duplicate. — BalusC, Dec 14 '20 at 09:59

score 2 · Accepted Answer · answered Dec 13 '20 at 08:47

Your HTML page is being rendered in the user's browser, running in one process. Your servlet is running in a servlet engine, in a JVM, in a different process, and probably on a different computer.

The only way they can communicate is via HTTP requests from the browser to the servlet engine.

There is no way for the browser to find classes in the JVM, all it can do is blindly send HTTP requests to the URLs that were rendered in the HTML and hope that the servlet engine responds.

It would be possibly to provide a servlet which despatched HTTP requests based on class names given in a parameter of the HTTP request, which would then do what you suggest.

Why I can't "directly" call Servlet from HTML?

1 Answers1