Securing the Application

Back from holiday!!! Looking forward to finish the project. Time for a security section.

I decided to implement the basic form authentication, which appears to be the best solution in order to achieve authentication using the login form. Moreover it allows me to decide the appearance of the login form, in order to better suit the application which it belongs to.

The diagram that explains the authentication mechanism is visible in the next figure:

Form-based authentication diagram

The main point here is the keyword j_security_check which represents the destination in the servlet container that handles authorization and authentication. The action attribute of the HTML tag form must have this value.

More information about the form-based authentication is visible at the Java EE 6 tutorial: http://download.oracle.com/javaee/6/tutorial/doc/gkbaa.html#bncbq

Moreover I have to choose if I want to implement the security following a declarative paradigm or a programmatic paradigm.

• With declarative security, all the security settings of the application (authentication requirements, roles, security controls...) are specified using annotations and/or deployment descriptors.Thus the security relies on the container for its management.
• With programmatic security, the security is managed directly by entities, classes, servlets and page views. In other words, it is integrated inside the application.

Intuitively I will follow the first approach.

Building the Shopping Cart

I finally arrived at a crossroad! The requirements for this project also include the use of Stateful Session Beans. Googoling around I discovered that Stateful Beans are often used for maintaining Shopping Carts, due to their ability to track the whole user session. I also found some tutorials on how implement them. Intuitively the implementation of a shopping cart can be made by using simply the HttpSession, however Stateful Beans have considerable advantages, as this link points out: http://www.java-tips.org/java-ee-tips/enterprise-java-beans/choosing-between-httpsession-and-stateful-session.html

So I created a Stateful bean called ShoppingCart implementing the Remote interface ShoppingCartInterface. However I was not sure on how reference it in the servlets. I tried using the annotation @EJB to inject the bean, but it didn't work. Finally, digging out some stackoverflow questions, I found what I was looking for: http://stackoverflow.com/questions/2811312/stateful-ejbs-in-web-application and http://stackoverflow.com/questions/2833457/how-do-i-obtain-a-new-stateful-session-bean-in-a-servlet-thread

I had to create an object ShoppingCart and save it in the HttpSession, in order to be used across requests. I decided to create an instance of ShoppingCart when the customer goes in the Management section of the application. So using these few lines of code:


ShoppingCart cart = (ShoppingCart) session.getAttribute("cart");


if (cart == null) {
   try {
      Context ctx = new InitialContext();
      cart = (ShoppingCart) ctx.lookup("java:comp/env/cart");
      session.setAttribute("cart", cart);
   }
}


everything was magically working. 

Session Timeout

The application design is proceeding very well. I managed to finish it in a couple of weeks. Now I'm focusing on some little details, like the session timeout. This parameter can be configured in the web.xml deployment descriptor, as follows:

<session-config>
   <session-timeout>30</session-timeout>
</session-config>


The value is expressed in minutes. It's clear that a low value (say 2-5 minutes) could affect the usability of the site and have a negative impact on the customer. On the other hand, a high value means a large number of sessions managed by the application server, that could possibly lead to high memory usage. Thus perfect value, in my opinion, is 10 minutes.


However here it comes another question: how can I handle situations in which a request is received for a session that has timed out or cannot be identified? The answer is simple: using a filter that intercepts all requests and checks if a session exists, and if not, it forwards the request to the index page. What is a filter? Here the answer: http://javaboutique.internet.com/tutorials/Servlet_Filters/

Back on work again!

Finally I'm back to work. I decided to dedicate myself to the user interface of the application, because I think this is not-so-challenging task. I'm still pretty busy with other exams, so I need something easy to fill my spare time. For this purpose I bought a little manual on CSS (http://www.apogeonline.com/libri/9788850327713/scheda) which hopefully will help me through the designing process. I'm aware that CSS is often bad interpreted on different browsers, especially in IE (wow!!! Really?), but I am not going to care so much about that fact: the design is working on my Firefox 3.6? Perfect! I'm done!

Temporary Suspension

Unfortunately I have to dedicate myself on other projects and exams, thus I planned to stop working on this project. I hope to restart soon. See ya!

JPA and Many-to-Many relationships

I spent a few days in order to clearly comprehend how JPA really works. In particular I was hesitant about the relation between the User table and the Instructor/Customer tables. After generating the Entity classes from the tables using the guided procedure on Eclipse I discovered that the User entity had a many-to-many relation with Customer and a many-to-many relation with Instructor. I was not sure if it was correct and how I had to manage it, however it turned out that everything was correct and the matter was simpler than I could ever expected.

The relation was clearly many-to-many due to the connection tables user_customer and user_instructor. For this reason the User entity has a Set of Customer entity and a Set of Instructor entity in it. So accessing one of the two, after retrieving the User from the DB using the email as PK, was quite a joke:

User user = em.find(User.class, email);
Customer customer = user.getCustomers().iterator().next();

Et voilà! I have my Customer entity ready for use.

Here are some useful links on the subject:
http://www.giuseppesicari.it/articoli/jpa-java-persistence-api/
http://en.wikibooks.org/wiki/Java_Persistence/Relationships
http://www.oracle.com/technetwork/articles/javaee/jpa-137156.html

domain.xml damaged

Unfortunately today I went straight into an unexpected blackout. I didn't lost anything because I used to save my work very often, however when I switched back on my PC I discovered that Glassfish was not working anymore. By double-clicking on the Glassfish server in the Servers tab of Eclipse I discovered that the Server Port Number and Admin Server Port Number parameters were setted to the wrong values (8080111 and 4848111 respectively instead of 8080 and 4848). Trying to launch Glassfish I always received an error message, which was obviously that 8080111 was not a valid port in the range 1 - 65536. After an hour of investigation I discovered that the domain.xml file inside the glassfish/domains/domain1/config folder was completely corrupted. Luckily in the same folder there was a backup file called domain.xml.bak, so I just copy-paste the content inside the original file and everything worked again.