To configure Tomcat HTTP Basic Authentication with SSL: Configure web app for basic authentication (add these in web.xml ): <security-constraint> <web-resource-collec... Three elements are needed for this to work: security-constraint with the url-pattern to protect, login-config for the type of authentication method to use, and security-role for the role name(s) used in the security-constraint . Add login info to conf/tomcat-users.xml : <tomcat-users> <role rolename="testUserRole... Turn on SSL in conf/server.xml : <Connector port="8443" protocol="HTTP/1.1" SSLEnab... For default keystore file ${user.home}/.keystore , the keystoreFile attribute can be omitted. Otherwise, add keystoreFile="/path/to/keystore/file" . The setup is different if you are using APR .

Create an openssl configuration file which enables subject alternative names ( openssl.cnf ): [req] distinguished_name = req_distinguished_... Create a certificate request using above configuration file: C:\work>openssl req -new -key testServer.key -out ... Verify the request was created successfully: C:\work>openssl req -text -noout -in testServer.cs... (Optional) self-sign the certificate request: C:\work>openssl x509 -req -days 3650 -in testServe...

A task that a Java developer does so frequently is to find out where a certain class can be found - to resolve compilation errors, classpath issues, or version conflicts of the same class introduced by multiple class loaders. A long while back I wrote a simple Perl script to perform the task. Later I was informed that there are Swing based Jar Browser and Jars Browser . Then, there are a couple of shell one-liners: # one liner 1 find -name "*.jar" -print0 | xarg... But all of them share the same problem: if a class is in a jar nested in another jar, it cannot be found. Such is the case for a class inside a jar under the WEB-INF/lib directory of a...

This is the task: your client wants to know how the web application is used. That is pretty easy. A plethora of commercial tools or any of the free log analysis tools such as analog and AWStats would fit the bill. But here's the catch: they want to know not only what pages are visited by how many people and when, but also who logged in and did what. Your application is using form based authentication and therefore, everyone is anonymous in the web access log. What to do? This is a servlet filter that generates a web access log with authenticated user info that can be fed to log analysis tools such as analog and AWStats . Filter code (the output format is Apache...

Once you apply a filter to a URL pattern: <filter-mapping> <filter-name>theFilter</fi... there's no option in web.xml to exclude a more specific pattern such as: /public/* . But you can put the exclusion logic in the filter itself: <filter> <filter-name>theFilter</filter-nam... And in the filter code: public void init(FilterConfig cfg) throws ServletE...

Two steps to configure a servlet filter in web.xml : Define the filter Apply the filter to a URL pattern and/or a servlet web.xml fragment: <!-- Declare the filter --> <filter> <fi...

I tried to find a GZIP compression servlet filter to compress a large log file that we send down to the browser. Most of the implementations I found were overly complicated and many buggy. This is a simple implementation that worked for me. The filter: package filter.demo; import java.io.*; i... Config web.xml : <filter> <filter-name>gzipFilter</filte... The ugly anonymous inner class could have been avoided if the servlet API did not insist on ServletResponse.getOutputStream returning the bogus ServletOutputStream class (instead of the plain OutputStream ). Additional Note: In an earlier version of this filter, the gzip headers were added in doFilter , like this: // This is NOT good! if (supportsGzip) { ... It turned out that the ServletResponse methods sendError bypasses the gzip...

I have long noticed that IE8 displays a "broken page" icon while showing my web pages, but didn't pay much attention. Since the world in general considers IE to be broken, it's not so unlogical for IE to see much of the world as broken. Until one day I noticed that the Google home page was not "broken". Then I thought may be I should fix my pages also. So I moused over the "broken page" icon, and this is what I saw: Compatibility View: websites designed for older browsers will often look better, and problems such as out-of-place menus, images, or text will be corrected. Very descriptive indeed! Older browsers? Such as Firefox 1.5? When it comes to MS products, I often had better...

The log line was like this: 2011-01-19 15:16:34,842 INFO [STDOUT] (HDScanne... Note that INFO and timestamp were printed twice. Based on my configuration, I was expecting something like this: 2011-01-19 15:16:34,842 INFO [XmlWebApplicationC... i.e., the logger name should have been XmlWebApplicationContext , not STDOUT ! What was the problem? I found this error message in server.log : 2011-01-19 14:34:38,107 ERROR [STDERR] (main) lo... It turned out that org.apache.log4j.Appender was loaded by my web application class loader, whereas org.jboss.logging.appender.FileAppender was loaded by the JBoss bootstrap class loader. Removing the log4j jar from my web application archive fixed the problem (sine log4j is already available in JBoss). Why was the logger changed to STDOUT? JBoss detects that there's a problem with the log4j configuration and routes all...

Create the stuff you want to manufacture with the factory: package tc.demo; public class Junk { ... Create the factory: package tc.demo; import java.util.Enumerati... Tell Tomcat to use your factory. Create file context.xml and put it under the directory META-INF of your web application: <Context> <Resource name="/find/junk/here" ... Note that beside name , type and factory , you can put any arbitrary attribute in the Resource element. Access the thing with JNDI: <%@page language="java" import="javax.naming.*,tc.... The server side log looked like this: INFO: jndiName: here INFO: name: scope, value: ... Also note that, in contrast to Tomcat documentation , resource-ref is not needed in web.xml .