The difference between session.getServletContext () and session.getServletContext (). GetContext ("/ SampleProject")

Question

I have an instance of Tomcat 6 running on my local machine.

I made the following changes to my configuration:

• In / conf / context.xml - changed the tag as follows

   <Context crossContext="true"> 

• In / conf / server.xml - changed the tag as follows

   <Connector port="8080" protocol="HTTP/1.1" emptySessionPath="true" connectionTimeout="20000" redirectPort="8443" /> 

Suppose I have a WAR file called SampleProject.war , which is unpacked here, which is extracted to the SampleProject folder.

In some servlet in this WAR, say SampleServlet , I write two blocks of code as follows:

 ServletContext context1 = session.getServletContext(); 

and

 ServletContext context2 = session.getServletContext().getContext("/SampleProject"); 

What is the difference between context1 and context2 ? I thought both relate to the application context. But if I set some attribute in context1 and access in context2 , I don't get the value in context2 .

Any help would be appreciated.

Answer 1

I feel that your question was a little misunderstood and that you already had a basic understanding of the API, i.e. when a web application sets its crossContext="true" , it can use getContext() to access a context that matches any other -app network deployed to the server.

 getServletContext().getContext() equals NULL unless <Context crossContext="true"> 

From what I understood, your question actually is that in /SameWebApp why

 ServletContext context1 = session.getServletContext(); context1.setAttribute("contextAttribute", new Object()); ServletContext context2 = session.getServletContext().getContext("/SameWebApp"); System.out.println(context1.equals(context2)); // prints false, or System.out.println(context2.getAttribute("contextAttribute")); // prints null (at least they could have been clones) 

In one word, the answer is "Security." Imagine if you could not guarantee that the "adminEmail" context attribute was not tampered with by an evil web application that has crossContext=true . Your application can potentially help to compromise yourself as soon as the request "Forgot your password" appears! :)

Dive into the interior of Tomcat

Tomcat 7 provides the class ApplicationContext implements ServletContext , which returns with getContext("/context-root") as

  if (context.getCrossContext()) { // If crossContext is enabled, can always return the context return child.getServletContext(); } else if (child == context) { // Can still return the current context return context.getServletContext(); } else { // Nothing to return return (null); } 

Here, context belongs to the current web application, and child represents another web application. But hold on, what makes Tomcat call it a kid?

These two are not actually ApplicationContext , but instances of the StandardContext class, which implements Context , but instead of servlet-specific things, contain specific Tomcat configuration settings for a web application such as crossContext, hostname, mimeMappings, etc. StandardContext.getParent() gives you a Container and therefore it is referred to as a child of the above.

In any case, we are interested in the case when child == context true, i.e. getContext() was called on "/ SameWebApp ". The call is delegated to StandardContext.getServletContext() , which was implemented to return another instance from ApplicationContext .

This is why the attributes set in context1 are not found in context2 .

But wait, one more thing. Why is StandardContext.getServletContext() returned as

 return (context.getFacade()); 

A Tomcat instance basically runs two types of Java code:

• and
• deployed user

The container code is "Trusted" and can sometimes run with elevated privileges. On the other hand, the user code is not reliable and should be limited from compromising the internal components of Tomcat.

One of the things Tomcat does for this is always to include the ApplicationContextFacade around the ApplicationContext (and therefore StandardContext ). Therefore, just to remind you that the simple implementation of ServletContext is actually a StandardContext mapped to ApplicationContext , which is then wrapped in ApplicationContextFacade .

For more information on how ApplicationContextFacade works by using Reflection in tandem with the Globals.IS_SECURITY_ENABLED and SecurityUtil.isPackageProtectionEnabled() settings, see Why servlets access Tomcat ApplicationContext through a facade on SO.

References:
Tomcat 7 source code (download link)

Answer 2

These two context objects are completely different from the others. The Context1 object provides the current servlet context of the obj web application. (ServletContext context1 = session.getServletContext ();)

and

An object

context2 provides the servletcontext obj object of the specified web application (ServletContext context2 = session.getServletContext (). GetContext ("/ SampleProject");)

you install an object in one context and try to extract it from another context, so it is impossible to get an attribute from another context of the web application by placing it in the current context of the application. But you can get the attribute in a different context of the web application using the second method.

Answer 3

Think OO and Java EE + platform security standards.

The first call returns the final servlet context for the current application with all supported operations.

The second call returns a copy of the servlet context, which can be for any application. As stated (rather vaguely!) In javadoc, the goal is to allow you to receive RequestDispatcher so that you can send pages to other applications. Another important, but implied, requirement is the safe implementation and respect of Java EE specifications, which prevent the use of session state or servlet context between applications. Imagine that the terrible damage of “rogue App B” can be done by “good application A” if it can just change (or read) the context servlet data with brute force. That is why it is a copy.

Therefore, setting attributes in a copy does not result in changes to the original. You can argue that the copy should say "Operation without exception support." Alternatively, you could argue that getRequestDispatcher needs to be reorganized either into another class or allowed to pass the application URL. But, unfortunately, none of these things is true. B ^)