Oracle® Fusion Middleware Developing Web Applications, Servlets, and JSPs for Oracle WebLogic Server 12c (12.2.1.4.0) E90836-03 April 2021 Oracle Fusion Middleware Developing Web Applications, Servlets, and JSPs for Oracle WebLogic Server, 12c (12.2.1.4.0) E90836-03 Copyright © 2007, 2021, Oracle and/or its affiliates. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs (including any operating system, integrated software, any programs embedded, installed or activated on delivered hardware, and modifications of such programs) and Oracle computer documentation or other Oracle data delivered to or accessed by U.S. Government end users are "commercial computer software" or "commercial computer software documentation" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, reproduction, duplication, release, display, disclosure, modification, preparation of derivative works, and/or adaptation of i) Oracle programs (including any operating system, integrated software, any programs embedded, installed or activated on delivered hardware, and modifications of such programs), ii) Oracle computer documentation and/or iii) other Oracle data, is subject to the rights and limitations specified in the license contained in the applicable contract. The terms governing the U.S. Government’s use of Oracle cloud services are defined by the applicable contract for such services. No other rights are granted to the U.S. Government. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Intel and Intel Inside are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Epyc, and the AMD logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle. Contents Preface Documentation Accessibility xv Conventions xv 1 Introduction and Roadmap Document Scope and Audience 1-1 Guide To This Document 1-1 Related Documentation 1-2 Examples for the Web Application Developer 1-3 Avitek Medical Records Application (MedRec) 1-3 Web Application Examples in the WebLogic Server Distribution 1-3 New and Changed Features In This Release 1-4 2 Understanding Web Applications, Servlets, and JSPs The Web Applications Container 2-1 Web Applications and Java EE 2-1 Web Application Development Key Points 2-2 Servlets 2-2 Servlets and Java EE 2-3 What You Can Do with Servlets 2-3 Servlet Development Key Points 2-4 JavaServer Pages 2-4 JSPs and Java EE 2-4 What You Can Do with JSPs 2-5 Overview of How JSP Requests Are Handled 2-5 Web Application Developer Tools 2-5 Other Tools 2-6 Web Application Security 2-6 Limiting the Number of Parameters in an HTTP Request 2-6 Avoiding Redirection Attacks 2-7 P3P Privacy Protocol 2-7 iii Displaying Special Characters on Linux Browsers 2-8 Using HTTP Strict Transport Security 2-8 3 Creating and Configuring Web Applications WebLogic Web Applications and Java EE 3-1 Directory Structure 3-1 Accessing Information in WEB-INF 3-2 Directory Structure Example 3-2 Main Steps to Create and Configure a Web Application 3-3 Step One: Create the Enterprise Application Wrapper 3-3 Step Two: Create the Web Application 3-3 Step Three: Creating the build.xml File 3-4 Step Four: Execute the Split Development Directory Structure Ant Tasks 3-4 Configuring How a Client Accesses a Web Application 3-4 Configuring Virtual Hosts for Web Applications 3-5 Configuring a Channel-based Virtual Host 3-5 Configuring a Host-based Virtual Host 3-5 Targeting Web Applications to Virtual Hosts 3-5 Loading Servlets, Context Listeners, and Filters 3-6 Shared Java EE Web Application Libraries 3-6 Enabling GZIP Compression for Web Applications 3-7 4 Creating and Configuring Servlets What's New and Changed in Servlets 4-1 What's New and Changed in Servlet 3.1 4-1 What Was New and Changed in Servlet 3.0 4-2 Configuring Servlets 4-3 Servlet Annotations 4-4 Servlet Mapping 4-4 Setting Up a Default Servlet 4-6 Servlet Initialization Attributes 4-6 Writing a Simple HTTP Servlet 4-7 Advanced Features 4-9 Complete HelloWorldServlet Example 4-9 Debugging Servlet Containers 4-10 Disabling Access Logging 4-10 Usage 4-10 Example 4-11 Debugging Specific Sessions 4-11 iv Usage 4-11 Tracking a Request Handle Footprint 4-12 Usage 4-12 5 Creating and Configuring JSPs WebLogic JSP and Java EE 5-1 Configuring JavaServer Pages (JSPs) 5-1 Registering a JSP as a Servlet 5-2 Configuring JSP Tag Libraries 5-2 Configuring Welcome Files 5-3 Customizing HTTP Error Responses 5-4 Determining the Encoding of an HTTP Request 5-4 Mapping IANA Character Sets to Java Character Sets 5-4 Configuring Implicit Includes at the Beginning and End of JSPs 5-5 Configuring JSP Property Groups 5-5 JSP Property Group Rules 5-6 What You Can Do with JSP Property Groups 5-6 Writing JSP Documents Using XML Syntax 5-6 How to Use JSP Documents 5-7 Important Information about JSP Documents 5-7 6 Using JSF and JSTL Using JSF and JSTL With Web Applications 6-1 JavaServer Faces (JSF) 6-1 JavaServer Pages Standard Tag Libraries (JSTL) 6-2 JSF Backward Compatibility 6-2 Deploying JSF and JSTL Libraries 6-3 Referencing a JSF or JSTL Library 6-3 7 Configuring Resources in a Web Application Configuring Resources in a Web Application 7-1 Configuring Resources 7-1 Referencing External EJBs 7-2 More about the ejb-ref* Elements 7-3 Referencing Application-Scoped EJBs 7-3 Serving Resources from the CLASSPATH with the ClasspathServlet 7-5 Using CGI with WebLogic Server 7-6 Configuring WebLogic Server to Use CGI 7-6 Requesting a CGI Script 7-7 v CGI Best Practices 7-7 8 WebLogic Annotation for Web Components Servlet Annotation and Dependency Injection 8-1 Web Component Classes That Support Annotations 8-2 Annotations Supported By a Web Container 8-3 Fault Detection and Recovery 8-4 Limitations 8-4 Annotating Servlets 8-4 WLServlet 8-4 Attributes 8-5 Fault Detection And Recovery 8-6 WLFilter 8-6 Attributes 8-6 Fault Detection and Recovery 8-7 WLInitParam 8-7 Attributes 8-7 9 Servlet Programming Tasks Initializing a Servlet 9-1 Initializing a Servlet when WebLogic Server Starts 9-1 Overriding the init() Method 9-2 Providing an HTTP Response 9-3 Retrieving Client Input 9-4 Methods for Using the HTTP Request 9-6 Example: Retrieving Input by Using Query Parameters 9-6 Securing Client Input in Servlets 9-7 Using a WebLogic Server Utility Method 9-8 Using Cookies in a Servlet 9-8 Setting Cookies in an HTTP Servlet 9-9 Retrieving Cookies in an HTTP Servlet 9-9 Using Cookies That Are Transmitted by Both HTTP and HTTPS 9-10 Application Security and Cookies 9-10 Response Caching 9-10 Initialization Parameters 9-11 Using WebLogic Services from an HTTP Servlet 9-12 Accessing Databases 9-12 Connecting to a Database Using a DataSource Object 9-12 Using a DataSource in a Servlet 9-12 vi Connecting Directly to a Database Using a JDBC Driver 9-13 Threading Issues in HTTP Servlets 9-13 Dispatching Requests to Another Resource 9-13 Forwarding a Request 9-14 Including a Request 9-15 RequestDispatcher and Filters 9-15 Proxying Requests to Another Web Server 9-15 Overview of Proxying Requests to Another Web Server 9-16 Setting Up a Proxy to a Secondary Web Server 9-16 Sample Deployment Descriptor for the Proxy Servlet 9-17 Clustering Servlets 9-18 Referencing