The error message tells you in detail in what order the elements are supposed to be placed and how many of them are allowed. In other words, the ordering or amount of the elements inside the <web-app> of your web.xml is incorrect. For example, as per the error message, <servlet> needs to go before <servlet-mapping>. … Read more
The ServletContainerInitializer implementation is intented to be bundled in a JAR file which is in turn been dropped in /WEB-INF/lib of the webapp. The JAR file itself should have a /META-INF/services/javax.servlet.ServletContainerInitializer file containing the FQN of the ServletContainerInitializer implementation in the JAR. Please note that this file should thus not be placed in the webapp … Read more
You can’t delete headers afterwards by the standard Servlet API. Your best bet is to just prevent the header from being set. You can do this by creating a Filter which replaces the ServletResponse with a custom HttpServletResponseWrapper implementation which skips the setHeader()‘s job whenever the header name is Content-Disposition. Basically: @Override public void doFilter(ServletRequest … Read more
It’s not supported by Servlet API to have the URL pattern wildcard * in middle of the mapping. It only allows the wildcard * in the end of the mapping like so /prefix/* or in the start of the mapping like so *.suffix. With the standard allowed URL pattern syntax your best bet is to … Read more
Setting the maximum age to 0 is right. But it must have exactly the same other cookie properties, except of the value. Thus exactly the same domain, path, secure, etc. The value is optional, it can best be set to null. So, given the way how you created the cookie, Cookie cookie = new Cookie(“user”, … Read more
You can get it by the HttpSession#getServletContext(). ServletContext context = request.getSession().getServletContext(); This may however unnecessarily create the session when not desired. But when you’re already sitting in an instance of the HttpServlet class, just use the inherited GenericServlet#getServletContext() method. @Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { ServletContext context = getServletContext(); // … Read more
The order of elements in web.xml matters and in all examples I’ve come across, the <load-on-startup> comes after <init-param>. <servlet> <servlet-name>spring1</servlet-name> <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> <init-param> <param-name>contextConfigLocation</param-name> <param-value>/WEB-INF/spring-servlet.xml</param-value> </init-param> <load-on-startup>1</load-on-startup> </servlet>
Data sent over SSL (HTTPS) is fully encrypted, headers included (hence cookies), only the Host you are sending the request to is not encrypted. It also means that the GET request is encrypted (the rest of the URL). Although an attacker could force a client to respond over HTTP, so it is highly recommended to … Read more
The ServletConfig parameters are specified for a particular servlet and are unknown to other servlets. It is used for intializing purposes. The ServletContext parameters are specified for an entire application outside of any particular servlet and are available to all the servlets within that application. It is application scoped and thus globally accessible across the … Read more
As far as I know, “INF” stands for “Information”, as you said. It probably was named WEB-INF for similarity with the META-INF directory in JAR files. Sometimes the meaning of a directory changes so much over time that it no longer makes sense. For example, bin directories in Unix/Linux often contain non-binary “executable” files, such … Read more