Servlet container not recognizing WEB-INF

[Andrew Thompson]

I am doing some work with the nickberg.org site
and my contact there is uploading the files for me.
Something has gone wrong.

The page <http://www.nickberg.org/nb/preview.jsp>

Cannot seem to find the classes in
/WEB-INF/lib/org.jar

But then I tried a random experiment
and was shocked to find I could browse
the WEB-INF itself..
<http://www.nickberg.org/WEB-INF>

So, I have obviously f**ked up.

What needs to be done to get the server to
recognize the WEB-INF directory as the source
of Java classes and mark it as forbidden to
browsing?

[ If this is one of those 'check the servlet spec'
things, I would appreciate the keywords that guide
me to the answer I seem to have missed. ]

Some further info..
<http://uptime.netcraft.com/up/graph/?host=nickberg.org>
<http://www.nickberg.org/nb/test/javavrsn.jsp>

Thanks for any suggestions..

 

[Sudsy]

Andrew Thompson wrote:

What needs to be done to get the server to
recognize the WEB-INF directory as the source
of Java classes and mark it as forbidden to
browsing?

I use Apache and Tomcat in combination so my solution is to just
use a .htaccess file in the WEB-INF directory containing a single
line:
Deny from all

I believe you can achieve the same using a <Files> section in
httpd.conf; see how .htaccess is protected, for example.

Hope this helps...

 

[Andrew Thompson]

Andrew Thompson wrote:
...
..use a .htaccess file in the WEB-INF directory..
Deny from all ...
Hope this helps...

Thanks Sudsy, I've dropped the link to Luke
(the guy that co-ordinates the site) and we'll
see if it starts behaving as expected once
the access is denied.

 

[William Brogden]

I am doing some work with the nickberg.org site
and my contact there is uploading the files for me.
Something has gone wrong.

The page <http://www.nickberg.org/nb/preview.jsp>

Cannot seem to find the classes in
/WEB-INF/lib/org.jar

But then I tried a random experiment
and was shocked to find I could browse
the WEB-INF itself..
<http://www.nickberg.org/WEB-INF>

I am going to guess that your WEB-INF directory
does not have a web.xml in it, therefore the
servlet container does not recognize it as
a legal web application.

So, I have obviously f**ked up.

What needs to be done to get the server to
recognize the WEB-INF directory as the source
of Java classes and mark it as forbidden to
browsing?

[ If this is one of those 'check the servlet spec'
things, I would appreciate the keywords that guide
me to the answer I seem to have missed. ]

Some further info..
<http://uptime.netcraft.com/up/graph/?host=nickberg.org>
<http://www.nickberg.org/nb/test/javavrsn.jsp>

Thanks for any suggestions..

Bill

 

[Andrew Thompson]

I am going to guess that your WEB-INF directory
does not have a web.xml in it,

Indeed it does not. I made a collection of the
files I thought they'd need, but it did not occur
to me to include a web.xml. The classes I use
are in a single archive in the WEB-INF/lib, there
is no specific configuration or mapping required,
so I needed no adjustments to my local web.xml
to accomodate the new classes.

[ I am kludgily making the web-app in and around
my existing site on the local PC, so I need to be
careful to extract out the bits required only for
it. Or rather, more careful... ]

..therefore the
servlet container does not recognize it as
a legal web application.

Aha! I will investigate further and report back.

Thanks for the pointer.

 

[Andrew Thompson]

On Thu, 05 Aug 2004 06:03:21 GMT, Andrew Thompson wrote:

Partial success, but still no solution.

I am doing some work with the nickberg.org site
and my contact there is uploading the files for me.
Something has gone wrong.

The page <http://www.nickberg.org/nb/preview.jsp>

Cannot seem to find the classes in
/WEB-INF/lib/org.jar

But then I tried a random experiment
and was shocked to find I could browse
the WEB-INF itself..
<http://www.nickberg.org/WEB-INF>

So, I have obviously f**ked up.

What needs to be done to get the server to
recognize the WEB-INF directory as the source
of Java classes and mark it as forbidden to
browsing?

[ If this is one of those 'check the servlet spec'
things, I would appreciate the keywords that guide
me to the answer I seem to have missed. ]

Some further info..
<http://uptime.netcraft.com/up/graph/?host=nickberg.org>
<http://www.nickberg.org/nb/test/javavrsn.jsp>

Thanks for any suggestions..

I added a working web.xml and .htaccess
with the line 'Deny from all' to the
WEB-INF directory.

I am now unable to get a directory listing for
the WEB-INF, (good), but my classes are still
not being picked up by the .JSP's, so it seems
the WEB-INF is still not recgnized as the source
of the classes.

If this were my install at home. I'd drop Apache
and restart it. Would that be necessary on a
production site, or should the changes have been
picked up already?

 

[Tony Morris]

Andrew Thompson wrote:


I use Apache and Tomcat in combination so my solution is to just
use a .htaccess file in the WEB-INF directory containing a single
line:
Deny from all

It's a requirement of any compliant container not to allow files to be
served from the WEB-INF directory. SRV.9.5

Are you attempting to use Apache/Tomcat?
Having never used this combination, I can only guess that it is Apache
serving you these files, and certainly not Tomcat. Configure the appropriate
plug-in perhaps?

 

[Andrew Thompson]

....
Are you attempting to use Apache/Tomcat?
Yep.

Having never used this combination, I can only guess that it is Apache
serving you these files, and certainly not Tomcat. Configure the appropriate
plug-in perhaps?

....Now I look at the NetCenter info. for PhySci
more carefully, I notice it mentions 'Resin',
whereas the NickBerg site doesn't..
<http://uptime.netcraft.com/up/graph/?host=physci.org>

Is that the missing element?

[ I am pretty sure it is, but since I need to get
anything done via the co-ordinator who then approaches
the SysAdmin.. it all becomes a bit convoluted. ]

 

[Tony Morris]

...Now I look at the NetCenter info. for PhySci

more carefully, I notice it mentions 'Resin',
whereas the NickBerg site doesn't..
<http://uptime.netcraft.com/up/graph/?host=physci.org>

Is that the missing element?

I use Resin for both HTTP and as a servlet container. i.e. there is no need
for Apache.
Tomcat also includes its own HTTP server, so you don't *need* to use Apache.
You can, however, configure Resin as the servlet container, while Apache
serves HTTP, and the same can be said for the Tomcat servlet container.

 

[Andrew Thompson]

I use Resin for both HTTP and as a servlet container. i.e. there is no need
for Apache.
Tomcat also includes its own HTTP server, so you don't *need* to use Apache.
You can, however, configure Resin as the servlet container, while Apache
serves HTTP, and the same can be said for the Tomcat servlet container.

...hmmm. I'm afraid my level of confusion is
rising and falling throughout this thread, at
the moment it is 'Extreme'. ;-)

My (most current) question would be..

The page shown here..
<http://www.physci.org/codes/display.jsp?fl=/nb/test/javavrsn.jsp>
is viewable at the new site..
<http://www.nickberg.org/nb/test/javavrsn.jsp>

Note that it determines/displays the Java
version that the server is running.

This displayed as literal text/HTML before
they 'installed Java', then it changed to 1.3.1(?!),
after which I got them to upgrade it to 1.4+.
It now reads '1.4.2_05'.

This indicates to me that the server, is,
to *some* extent, Java aware.

Could it display the Java version if
there were no 'servlet container'?

 

[Sudsy]

Andrew Thompson wrote:

Yep.
<http://uptime.netcraft.com/up/graph/?host=nickberg.org>
..Well Apache certainly.

<snip>

Only for you, mate! You're running Apache 1.3.29 and Tomcat 4.1.30
on that site (don't ask me to tell you how I determined that). As
such, the standard rules should apply. What it comes down to is
where the app was deployed. It should have been in a subdirectory
of $TOMCAT_HOME/webapps. In point of fact, you can copy the war
file to that directory and it should autodeploy. If you have only
one (default) app then you should manually unjar it to the ROOT
subdirectory.
Drop me a note off-line and let's see if we can get this squared
away and you can post the ultimate solution back here.

 

[Andrew Thompson]

Servlet container not recognizing WEB-INF - * Solved *

.

Drop me a note off-line and let's see if we can get this squared
away ..

Thanks Sudsy, you saved the day on this one!

.. and you can post the ultimate solution back here.

Our communications quickly narrowed it down to the
server.xml, which Sudsy immediately recognised was faulty.

The Context element was missing the 'appBase' attribute..
Exactly how it became missing in the first place remains a mystery.

The fix was quickly forthcoming, but it took a long
time to communicate the corrected file back through the
(rather long) lines of communication.

The server is now up and running, and I can continue
with the installation and testing that has languished
for over a month now. ( Yay! )

Thanks also, to William and Tony for their responses.

--
Andrew Thompson
http://www.PhySci.org/codes/ Web & IT Help
http://www.PhySci.org/ Open-source software suite
http://www.1point1C.org/ Science & Technology
http://www.lensescapes.com/ Images that escape the mundane