Servlet Validation and Redirection Problem

[nobr]Hello,

I have a Validation Servlet that mapped in web.xml so:

<servlet>

<servlet-name>Validation</servlet-name>

<servlet-class>project.Validation</servlet-class>

</servlet>

<servlet-mapping>

<servlet-name>Validation</servlet-name>

<url-pattern>/valid</url-pattern>

</servlet-mapping>

I use ajax and by doGet(), if all fields was filled correctly send such an XML fragment to the browser:

<valid>

<name>true</name>

<data>true</data>

</valid>

JavaScript get this XML and check, and if all fields was filled correctly, submit the form and redirect user by doPost (Servlet)

context.getRequestDispatcher("/uploadedOK.jsp").forward(request, response);

The user see the following URL in the browser, after submition:

http://localhost:8080/project/valid

If the user copy and paste this link later in the browser, the doGet() method will be executed in the Servlet, the user see the xml fragment:

<valid>

<name>false</name>

<data>false</data>

</valid>

How can I redirect the user, that he instead of

http://localhost:8080/project/valid

see in the browser: http://localhost:8080/project/uploadedOK.jsp

And how can I redirect the user to the /project/index.jsp

if the user copied the http://localhost:8080/project/valid

in his browser. The doGet() method will be always executed with this XML tags and can confuse user. I also don't want the user to call this link, only if it get through the form.

Here is the html form code:

<form id="submitForm" action="valid"

enctype="MULTIPART/FORM-DATA"

method="post"

onsubmit="validateUserData(); return false;">

<table align="center" width="330">

<tr>

<td colspan="2">

<b><div id="Message"></div></b>

</td>

</tr>

<tr>

<td><b><div id="nameMessage">Name:</div></b></td>

<td><input type="text" name="name" id="nameId" /></td>

</tr>

<tr>

<td><b><div id="dataMessage">Data:</div></b></td>

<td><input type="text" name="data" id="dataId" /></td>

</tr>

<tr>

<td colspan="2" align="right"><br>

<input type="submit" value="Sent" /></td>

</tr>

</table>

</form>

JavaScript code

<script type="text/javascript">

function AJAXInteraction(url, callback){

var req = init();

req.onreadystatechange = processRequest;

function init(){

if (window.XMLHttpRequest){

returnnew XMLHttpRequest();

}elseif (window.ActiveXObject){

returnnew ActiveXObject("Microsoft.XMLHTTP");

}

}

function processRequest (){

// readyState of 4 signifies request is complete

if (req.readyState == 4){

// status of 200 signifies sucessful HTTP call

if (req.status == 200){

if (callback) callback(req.responseXML);

}

}

}

this.doGet = function(){

req.open("GET", url,true);

req.send(null);

}

}

function validateUserData(){

var name = document.getElementById("nameId");

var data = document.getElementById("dataId");

var url ="validate?name=" + encodeURIComponent(name.value) +

"&data=" + encodeURIComponent(data.value);

var name = document.getElementById("nameId");

var data = document.getElementById("dataId");

var ajax =new AJAXInteraction(url, validateCallback);

ajax.doGet();

}

function validateCallback(responseXML){

var msg = responseXML.getElementsByTagName("name")[0].firstChild.nodeValue;

var isRight =true;

if (msg =="false"){

var mdiv = document.getElementById("nameMessage");

// set the style on the div to invalid

mdiv.className ="f_invalid";

mdiv.innerHTML ="Name:";

isRight =false;

}else{

var mdiv = document.getElementById("nameMessage");

mdiv.className ="f_correct";

mdiv.innerHTML ="Name:";

}

var msg = responseXML.getElementsByTagName("data")[0].firstChild.nodeValue;

if (msg =="false"){

var mdiv = document.getElementById("dataMessage");

// set the style on the div to invalid

mdiv.className ="f_invalid";

mdiv.innerHTML ="Data:";

isRight =false;

}else{

var mdiv = document.getElementById("dataMessage");

mdiv.className ="f_correct";

mdiv.innerHTML ="Data:";

}

if (isRight){

var mdiv = document.getElementById("Message");

mdiv.className ="f_correct";

mdiv.innerHTML ="";

var mform = document.getElementById("submitForm");

mform.submit();

}else{

var mdiv = document.getElementById("Message");

mdiv.className ="f_invalid";

mdiv.innerHTML ="Error.";

}

}

</script>

ServletCode:

package project;

publicclass Validationextends HttpServlet{

private ServletContext context;

publicvoid init(ServletConfig config)throws ServletException{

super.init(config);

this.context = config.getServletContext();

}

publicvoid doGet(HttpServletRequest request, HttpServletResponse response)

throws IOException, ServletException{

request.setCharacterEncoding("UTF-8");

ArrayList tags =new ArrayList();

String nameId = request.getParameter("name");

if (nameId !=""){

tags.add("<name>true</name>");

}else{

tags.add("<name>false</name>");

}

String dataId = request.getParameter("data");

if (dataId !=""){

tags.add("<data>true</data>");

}else{

tags.add("<data>false</data>");

}

if (!tags.isEmpty()){

response.setContentType("text/xml");

response.setHeader("Cache-Control","no-cache");

response.getWriter().write("<valid>");

for (int i = 0; i < tags.size(); i++){

response.getWriter().write(tags.get(i).toString());

}

response.getWriter().write("</valid>");

}

}

publicvoid doPost(HttpServletRequest request, HttpServletResponse response)

throws IOException, ServletException{

context.getRequestDispatcher("/uploadedOK.jsp").forward(request, response);

}

This is of course a sample of easy validation, but there will be a more complex validation on the server side and maybe the javaScript validation on the client side. I want to use the Ajax approach for the form validation. If there are some errors, some text will be updated on the page in the browser. If this approach with doGet() and doPost() is not good, I am glad to hear your advices, how to improve this. Maybe, there is the other possibility to send response from the server, without this xml tags. Please help me.[/nobr]

[12132 byte] By [flexeda] at [2007-10-2 23:32:15]
# 1

It sounds like you are using an AJAX request to do a client-side validation on the server? And then if its valid, posting the form? That sounds completely convoluted.

I think your real question involves redirection though. If you use the request dispatcher to forward, the forwarding happens within the container and the URL doesn't change in the browser.

A strategy that might work for you is to use request.sendRedirect() instead, after processing the form.

jleecha at 2007-7-14 16:13:22 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 2

Thank you very much, that you took some time to read and understand my question and thanks for the answer.

> It sounds like you are using an AJAX request to do a

> client-side validation on the server? And then if

> its valid, posting the form? That sounds completely

> convoluted.

In this case we don't need to use AJAX for validation, it could be just a JavaScript on the Client-Side to validate the insertion, but in some other cases it could be necessary. Or do you think that it could be done in some different way?

Yes, I use Ajax to validate the insertion after all fields was filled up and the button was submited. It can be used also for the login form. Like on this forum,

https://softwarereg.sun.com/registration/developer/en_US/login

They check login and password by POST and if it is not correct, add dynamically some Error messages. I didn't find any Ajax issues in the code of the forum, but I suppose that it is used here. Am I right?

> I think your real question involves redirection

> though. If you use the request dispatcher to

> forward, the forwarding happens within the container

> and the URL doesn't change in the browser.

> A strategy that might work for you is to use

> request.sendRedirect() instead, after processing the

> form.

You are right. The redirection will be the right thing here. In my case after the form was submited and all was ok, by doPost() the user go to http://localhost:8080/project/valid, well I can try to redirect him.

How can I forbid the call of the link http://localhost:8080/project/valid in the browser, and to allow the call only through form?

The connection with a server get through ajax by doGet(). If the user past the link in the browser http://localhost:8080/project/valid he will also get some xml tags

<valid>

<name>false</name>

<data>false</data>

</valid>

How can I redirect the user in this case by doGet() to the form http://localhost:8080/project/input.jsp and if it is JavaScript from Ajax to send this xml tags?

flexeda at 2007-7-14 16:13:22 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 3

> Thank you very much, that you took some time to read

> and understand my question and thanks for the

> answer.

>

> > It sounds like you are using an AJAX request to do

> a

> > client-side validation on the server? And then if

> > its valid, posting the form? That sounds

> completely

> > convoluted.

>

> In this case we don't need to use AJAX for

> validation, it could be just a JavaScript on the

> Client-Side to validate the insertion, but in some

> other cases it could be necessary. Or do you think

> that it could be done in some different way?

>

I would use as much client-side validation as you can, and when you submit the form do any necessary server side validation, once, prior to processing it. You should consider submitting the form itself over ajax.

> Yes, I use Ajax to validate the insertion after all

> fields was filled up and the button was submited. It

> can be used also for the login form. Like on this

> forum,

>

> https://softwarereg.sun.com/registration/developer/en_

> US/login

>

> They check login and password by POST and if it is

> not correct, add dynamically some Error messages. I

> didn't find any Ajax issues in the code of the forum,

> but I suppose that it is used here. Am I right?

>

> > I think your real question involves redirection

> > though. If you use the request dispatcher to

> > forward, the forwarding happens within the

> container

> > and the URL doesn't change in the browser.

> > A strategy that might work for you is to use

> > request.sendRedirect() instead, after processing

> the

> > form.

>

> You are right. The redirection will be the right

> thing here. In my case after the form was submited

> and all was ok, by doPost() the user go to

> http://localhost:8080/project/valid, well I can try

> to redirect him.

>

> How can I forbid the call of the link

> http://localhost:8080/project/valid in the browser,

> and to allow the call only through form?

>

You can't. That is why I recommend not having a specific servlet that does validation.

> The connection with a server get through ajax by

> doGet(). If the user past the link in the browser

> http://localhost:8080/project/valid he will also get

> some xml tags

>

> <valid>

> <name>false</name>

> <data>false</data>

> </valid>

>

> How can I redirect the user in this case by doGet()

> to the form http://localhost:8080/project/input.jsp

> and if it is JavaScript from Ajax to send this xml

> tags?

You can't tell if the user submitted something himself or if it was submitted over AJAX on behalf of the user. Even if you hacked something together, it would be defeated. Any request the browser can make, the user can make, modified to exploit a weakness.

jleecha at 2007-7-14 16:13:22 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 4

>

> I would use as much client-side validation as you

> can, and when you submit the form do any necessary

> server side validation, once, prior to processing it.

Yes, I think it is a good approach.

> You should consider submitting the form itself over

> ajax.

Do you also use ajax + servlet to make some validation, I mean to send data, when it was checked on the client machine? In the sample above, the form will be validated by doGet() and then will be called the servlet and the doPost().

Is there any possibility, to use ajax + doPost() without doGet()?

I submit the form, all is correct, doPost() - servlet and then, if some fields are not correct send some messages. Like the login form on this Sun Forum.

I don't know how from the doPost() method the same page with a form will be connected and make some changes (Error messages). I can after the check redirect oder dispatch, but in this case if there are some errors, the page will be updated and it won't be ajax.

flexeda at 2007-7-14 16:13:22 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 5
> Is there any possibility, to use ajax + doPost()> without doGet()?Yes. You can POST from XMLHttpRequest.
jleecha at 2007-7-14 16:13:22 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 6
> Yes. You can POST from XMLHttpRequest.Do you know some resources, where I could read about it.Can I post with frames?
flexeda at 2007-7-14 16:13:22 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...