Java EE web technology version history (updated)

JSR numbers are included as links.
Servers are webcontainers.Take care, web containers do not include JSF. You have to add it yourself or use an enterprise application server. Enterprise application servers are included in the
complete Java EE version overview.

Java EE	servlet	JSP	EL	JSTL	JSF	WebSocket	MVC	Server	What’s new
	2.1	1.0						iPlanet jetty 1	ServletContext, RequestDispatcher
1.2	2.2	1.1						tomcat 3.3 jetty 3	war
1.3	53 2.3	53 1.2						tomcat 4.1 jetty 4	filters
1.4	154 2.4	152 2.0	1.0	52 1.1				tomcat 5.5 jetty 5
5	2.5	245 2.1	2.1	1.2	127 1.2			tomcat 6 jetty 6	annotations
6	315 3.0	2.2	2.2		314 2.0			tomcat 7 jetty 8	asynchronous servlets, EL method calls, more...
7	340 3.1		341 3.0		344 2.2	356 1.0		tomcat 8 jetty 9.1	HTML 5, non blocking (Listener) servlet IO
8	369 4.0				372 2.3	1.1	371 1.0	tomcat 9	HTTP/2

Programmatic servlet configuration

Servlet 3 allows you to configure your webapplication in Java.
A set of methods have been added to ServletContext to support this, e.g.

• addFilter
• addListener
• addServlet

When your application starts, you can call these methods from a  ServletContextListener:

@WebListener
public class MyServletContextListener implements ServletContextListener {
  public void contextInitialized(ServletContextEvent event) {
    ServletContext ctx = event.getServletContext();
    ServletRegistration servlet = ctx.addServlet ("ProServlet","org.edu.ProServlet");   
    servlet.addMapping("/dyna/*");
  }
  public void contextDestroyed(ServletContextEvent event) {}
}

After the ServletContext is initialised, you can't call these methods anymore.

Servlet listeners

Scope	Lifecycle listeners	Attribute change listeners	Register
Application	ServletContextListener	ServletContextAttributeListener	@WebListener
Servlet	HttpServlet		@PostConstruct @PreDestroy
Session	HttpSessionListener	HttpSessionAttributeListener	@WebListener
Request	ServletRequestListener	ServletRequestAttributeListener	@WebListener
Asynchronous Request	AsyncListener		AsyncContext#addListener

• Additional Session Listeners:
  • HttpSessionBindingListener: Notifies an attribute that it is bound/unbound from the session attribute map
  • HttpSessionActivationListener: Notifies an attribute that it is passivated to/activated from persistent storage (session passivation)
• WebListeners can also be registered using
  • web.xml

    <web-app>
      <listener>
        <listener-class>org.edu.MyListener</listener-class>
      </listener>
    …
    </web-app> 

    
    
  
  
  
  • programmatically using ServletContext#addListener from a ServletContextListener
  
  
  
  



• Example of using a ServletContextListener

What’s new in Servlet 3 (edit)

Servlets 3 (JSR 315) highlights:

• Instead of configuring the web application in the web.xml deployment description you now have more options
• modular deployment descriptor
  jars can be bundled with your webapp containing a web-fragment.xml file. These files are merged with the main web.xml file of your webapp. This allows for easy plugging in of web application modules. If you plugin a framework jar, you won’t have to modify the web.xml of your application anymore (e.g. to send all *.do files to a framework servlet).
• annotations

  @WebServlet ("/jeeves")
  public class ZServlet extends HttpServlet {
  ....
  }

  • Extends HttpServlet, no POJO (yes!)
• programmatic configuration

• Asynchronous servlets
  

  @WebServlet ("/jeeves", asyncSupported=true) 
  public class ZServlet extends HttpServlet { 
  private AsyncContext ctx
  
  public void doGet( HttpServletRequest req, HttpServletResponse res) { 
  
     ctx = req.startAsync(); 
    // kick off a thread for async work
    ctx.start(new L8r());
    //method returns immediatly, no response sent
  } // end doGet method
  
  class L8r implements Runnable{
     public void run(){
      // do work
      ...
      // response ready
      ctx.complete();
      // alternative: ctx.dispatch("responseViewer.jsp");
    } // end run method
   } //end L8r class
  } //end ZServlet class

  
  The asynchronous servlet doGet() method does not wait for the L8r thread to complete. The request/response parameters however are not committed, but they are cached in AsyncContext. The L8r thread can then use these to reply to the waiting client.
• Security
  
  • ProgrammaticLogin class
  • Java EE5 authorisation annotations
    
    • @RolesAllowed
    • @PermitAll
    • @DenyAll
  • @transportprotected: use SSL
  • Session security

  <session-config>
  <!-- do not expose session id by using URL rewriting --> 
    <tracking-mode>COOKIE</tracking-mod>
    <cookie-config>
      <!-- do not expose cookie to javascript-->
      <http-only>true</ttp-only>
      <!-- only transit cookie over encrypted connection-->
      <secure>true</secure>
    </cookie-config>
  </session-config>
  

• EL 2.2
  Method calls are now possible from EL, e.g.:
  

    #{portfolio.add('ORCL',100)}

  
  
• File upload (aka multipart support) 

Servlet 3 (JSR 315) containers (edit)

 Servlet v3 support in different web application containers + current support state

• Glassfish 3+ (12/2009)
• Resin 4 (2/2010)
• JBoss 6 (12/2010)
• Tomcat 7 (1/2011)
• IBM WebSphere v8 (6/2011)
• Oracle WebLogic 12c (12/2011) 
• Jetty 8 (milestone)

JSP/servlet authentication

You can define authentication in the web.xml deployment descriptor of a web application.

1. Define roles

   <security-role>   
     <role-name>admin</role-name>    
   </security-role>    
   <security-role>    
     <role-name>boss</role-name>    
   </security-role>
   User definition is web container dependent. 

2. Define protected resources

   <security-constraint>   
     <display-name>Goodies</display-name>    
     <web-resource-collection>    
       <web-resource-name>Goodies</web-resource-name>    
       <description/>    
       <url-pattern>/Cookies</url-pattern>    
       <url-pattern>/Smarties/*</url-pattern>    
     </web-resource-collection>    
     <auth-constraint>    
       <description/>    
       <role-name>admin</role-name>    
       <role-name>boss</role-name>    
     </auth-constraint>    
   </security-constraint>

   Take care:
   • Is only guaranteed for cookie based sessions
   • Does not apply to forward and include
3. Define authentication method

   <login-config>   
     <auth-method>FORM</auth-method>    
     <realm-name/>    
     <form-login-config>    
       <form-login-page>/login.jsp</form-login-page>    
       <form-error-page>/login-error.jsp</form-error-page>    
     </form-login-config>    
   </login-config>

   The authentication form is supposed to have a POST action called j_security_check and j_username and j_password input fields.
   Other HTTP authentication methods are
   • BASIC: clear text password (base64 encoded)
   • DIGEST: hashed password (works in Firefox and IE 7+)
   • CLIENT-CERT: mutual certified SSL