Tomcat - disable servlet access

[asaguden]

Background:
I have a hosted site running JSP. The company hosting the site
uses Tomcat 4.1, and I can not use servlets, only JSP.
However I can extend servlets in my jsp so that 90% of the work
is done in the servlet anyway.

The issue:
I am experimenting with jsp servlet inheritance, trying to get as
small jsps as possible.
I would like a similar Tomcat setup (with servlets disabled) on
my local machine to test different scenarios, otherwise I have to
test it directly on the hosted site, no good.

How do I do this?
Regards

 

[marcus]

I would start by loading tomcat on your local machine

 

[asaguden]

Ok,
I have the same version Tomcat running on my local machine.
I have the same source code distributed in the same manner
onto the Tomcat server.
The tomcat server is up and fully functional - what I want to do is
limit the functionality to behave as the hosted Tomcat...

Now, how do I continue?

 

[Gerbrand]

asaguden schreef:

Ok,
I have the same version Tomcat running on my local machine.
I have the same source code distributed in the same manner
onto the Tomcat server.
The tomcat server is up and fully functional - what I want to do is
limit the functionality to behave as the hosted Tomcat...

Now, how do I continue?

jsp files are servlets, intermixed with html-code. Tomcat will convert
those jsp files to java files internally.
I think servlets are pretty essential part of webapplications. You
should really ask to change the settings on your companies server if
they have asked you to write an webapplication.

 

[asaguden]

I am really not getting through with my problem,
since you are creating your very own to help me solve mine!

I am fully aware of the innerworkings of jsp/servlets and
web applications, but the issue remains:
MY HOSTING PARTNER DOES NOT ALLOW SERVLETS TO BE DIRECTLY ACCESSED.

ok?

Now, can anyone lead me in the right direction of a solution of my
initial problem?
_____________________________________________________________

 

[Daniel Tryba]

Please don't TOFU.

I am fully aware of the innerworkings of jsp/servlets and
web applications, but the issue remains:
MY HOSTING PARTNER DOES NOT ALLOW SERVLETS TO BE DIRECTLY ACCESSED.

ok?

Now, can anyone lead me in the right direction of a solution of my
initial problem?

Why not ask the provider how they did it? Why do you have to disable it
anyway since you can only use jsp! Test with jsp only and if you think
you got your workaround test on the live server (you'd have to do that
anyway).

Are you actually talking to the tomcat machine directly?

 

[asaguden]

Thank you for a reply.
(i dont know what TOFU is..)

Well asking the provider I could do - but for now my pride holding me
back...

The thing is I do use jsp - for presentation. I would like to / and do
use
servlets for business processing like database interaction,session
management,
logging and request processing.

But I am experimenting in the use of the jspService() and hope to be
able to have a
jsp-controller that is completely empty, just an extended servlet.

If I test this locally I will never know why it worked since my local
Tomcat does not
complain to using servlets directly.

Then releasing to production - the problems arises, it is just a
pain...
And since I have th same version of Tomcat againt the same version of
mysql locally as prod, the need for testing in prod is minimal..

 

[Daniel Tryba]

Thank you for a reply.
(i dont know what TOFU is..)

Top Over Full Underquote.

Well asking the provider I could do - but for now my pride holding me
back...


The thing is I do use jsp - for presentation. I would like to / and do
use servlets [snip]
Then releasing to production - the problems arises, it is just a
pain... And since I have th same version of Tomcat againt the same
version of mysql locally as prod, the need for testing in prod is
minimal..

You aren't answering the important question: is a browser accessing a
jsp making a direct connection to tomcat?

I ask this since you haven't made clear what happens when you try to
access a servlet! The simplest way for a provider to block access to
servlets is to simply filter those requests (trivial with a proxy or
something like mod-jk), but that leaves full control to jsp

 

[Tor Iver Wilhelmsen]

I have a hosted site running JSP. The company hosting the site
uses Tomcat 4.1, and I can not use servlets, only JSP.

Since JSPs are servlets after Tomcat gets its hands on them, that
sounds like a strange requirement. The only practical differences
between a JSP and a servlet are

1) The JSP is output-centric, a servlet class is code centric

2) Extra lifecycle management of custom tags, compiled in by the JSP
compier

3) Extra default variables like "pageContext" and "out" provided to
the JSP author.

Both can e.g. receive URL mappings and aliases.

However I can extend servlets in my jsp so that 90% of the work
is done in the servlet anyway.

Yes. Which makes the "can not use servlets" requirement even more
strange.

 

[asaguden]

Daniel, thank you.

After your post I reread the hosting support info regarding jsp.
<quote>
....as JSP angine Tomcat is used, connected through AJP13 connector
and mod_jk to Apache...
</unquote>

I finally get it.
It is not Tomcat that refuses to deliver servlets,
those requests are filtered in Apache somehow. Can i 'fake' a servlet
as jsp and get away with it?
That is - can I write a servlet that does not get filtered?

I am thankful for all input.

Thank you for a reply.
(i dont know what TOFU is..)

Top Over Full Underquote.

Well asking the provider I could do - but for now my pride holding me
back...


The thing is I do use jsp - for presentation. I would like to / and do
use servlets [snip]
Then releasing to production - the problems arises, it is just a
pain... And since I have th same version of Tomcat againt the same
version of mysql locally as prod, the need for testing in prod is
minimal..

You aren't answering the important question: is a browser accessing a
jsp making a direct connection to tomcat?

I ask this since you haven't made clear what happens when you try to
access a servlet! The simplest way for a provider to block access to
servlets is to simply filter those requests (trivial with a proxy or
something like mod-jk), but that leaves full control to jsp

 

[marcus]

Ok, what I would do is ask your client for a tertiary
(developer.myhost.com) configured exactly the same for development work,
rather than try and duplicate an *unknown* environment by guesswork.
Since you feel their environment is non-standard it would behoove them
to cooperate

Daniel, thank you.

After your post I reread the hosting support info regarding jsp.
<quote>
...as JSP angine Tomcat is used, connected through AJP13 connector
and mod_jk to Apache...
</unquote>

I finally get it.
It is not Tomcat that refuses to deliver servlets,
those requests are filtered in Apache somehow. Can i 'fake' a servlet
as jsp and get away with it?
That is - can I write a servlet that does not get filtered?

I am thankful for all input.

Thank you for a reply.
(i dont know what TOFU is..)

Top Over Full Underquote.

Well asking the provider I could do - but for now my pride holding

me

The thing is I do use jsp - for presentation. I would like to / and

do

use servlets
[snip]

Then releasing to production - the problems arises, it is just a
pain... And since I have th same version of Tomcat againt the same
version of mysql locally as prod, the need for testing in prod is
minimal..

You aren't answering the important question: is a browser accessing a
jsp making a direct connection to tomcat?

I ask this since you haven't made clear what happens when you try to
access a servlet! The simplest way for a provider to block access to
servlets is to simply filter those requests (trivial with a proxy or
something like mod-jk), but that leaves full control to jsp