Advanced Servlet Features

🚀 Advanced Servlet Features: The Restaurant Kitchen Story

Imagine you run a busy restaurant kitchen. Regular cooking works fine when there are few orders. But what happens during rush hour? What if someone orders a huge cake that takes an hour? What if customers want to bring their own ingredients? And how do you keep the kitchen safe from intruders?

That’s exactly what Advanced Servlet Features solve for web applications!

🎭 The Three Superpowers

1️⃣ Servlet Async Processing

🍳 The Problem: The Slow Cake Order

Picture this: A customer orders a special cake that takes 1 hour to bake.

Without Async (Bad Kitchen):

👨‍🍳 Chef starts cake
⏳ All other customers WAIT 1 hour
😠 Everyone is angry

With Async (Smart Kitchen):

👨‍🍳 Chef puts cake in oven
📝 Takes other orders immediately
🔔 Oven timer rings when ready
🎂 Cake gets delivered

🎯 What is Async Processing?

Async means “start now, finish later”. The servlet says: “I’ll work on this, but don’t wait for me. Go help other customers!”

💡 How It Works

graph TD
    A["Request Arrives"] --> B["Start Async Context"]
    B --> C["Thread Returns to Pool"]
    C --> D["Background Work Happens"]
    D --> E["Async Thread Finishes"]
    E --> F["Response Sent"]

✨ The Magic Code

@WebServlet(urlPatterns = "/slow-task",
            asyncSupported = true)
public class SlowServlet extends HttpServlet {

    protected void doGet(HttpServletRequest req,
                         HttpServletResponse resp) {
        // 🎬 Start async mode
        AsyncContext ctx = req.startAsync();

        // ⏰ Set timeout (30 seconds)
        ctx.setTimeout(30000);

        // 🏃 Run in background
        ctx.start(() -> {
            try {
                // Simulate slow work
                Thread.sleep(5000);

                // Write response
                ctx.getResponse().getWriter()
                   .write("Done!");

                // 🏁 Signal completion
                ctx.complete();
            } catch (Exception e) {
                e.printStackTrace();
            }
        });
    }
}

🧩 Key Parts Explained

🎧 Async Listeners: The Kitchen Bell System

Want to know when things happen? Use listeners!

ctx.addListener(new AsyncListener() {
    public void onComplete(AsyncEvent e) {
        System.out.println("✅ Task done!");
    }

    public void onTimeout(AsyncEvent e) {
        System.out.println("⏰ Taking too long!");
    }

    public void onError(AsyncEvent e) {
        System.out.println("❌ Something broke!");
    }

    public void onStartAsync(AsyncEvent e) {
        System.out.println("🚀 Starting!");
    }
});

2️⃣ File Upload in Servlets

📦 The Problem: Customer Brings Ingredients

What if customers want to upload their own recipe photos? Or submit documents? Your servlet needs to accept files!

🎯 Two Ways to Accept Files

Think of it like two different delivery systems:

✨ The Magic Code

@WebServlet("/upload")
@MultipartConfig(
    fileSizeThreshold = 1024 * 1024,  // 1MB
    maxFileSize = 5 * 1024 * 1024,    // 5MB
    maxRequestSize = 10 * 1024 * 1024 // 10MB
)
public class UploadServlet extends HttpServlet {

    protected void doPost(HttpServletRequest req,
                          HttpServletResponse resp)
            throws ServletException, IOException {

        // 📥 Get the uploaded file
        Part filePart = req.getPart("myFile");

        // 📛 Get original filename
        String fileName = filePart
            .getSubmittedFileName();

        // 💾 Save to disk
        String path = "/uploads/" + fileName;
        filePart.write(path);

        resp.getWriter().write("Uploaded: " + fileName);
    }
}

🧩 @MultipartConfig Options

📋 Working with Parts

// Get one file by name
Part photo = req.getPart("photo");

// Get ALL uploaded files
Collection<Part> allParts = req.getParts();

// Loop through each file
for (Part part : allParts) {
    String name = part.getSubmittedFileName();
    long size = part.getSize();
    String type = part.getContentType();

    // Save it!
    part.write("/uploads/" + name);
}

🔍 Part Methods Cheatsheet

graph TD
    A["Part Object"] --> B["getSubmittedFileName"]
    A --> C["getSize"]
    A --> D["getContentType"]
    A --> E["getInputStream"]
    A --> F["write path"]

    B --> G["photo.jpg"]
    C --> H["2048576 bytes"]
    D --> I["image/jpeg"]

3️⃣ Servlet Security

🔐 The Problem: Kitchen Intruders!

Not everyone should enter your kitchen:

• Customers can order food
• Staff can enter kitchen
• Manager can access the safe

That’s role-based security!

🎯 Three Security Methods

🏷️ Method 1: Annotation Security

@WebServlet("/admin")
@ServletSecurity(
    @HttpConstraint(rolesAllowed = {"admin"})
)
public class AdminServlet extends HttpServlet {
    // Only admins can access this!
}

Different rules for different actions:

@ServletSecurity(
    value = @HttpConstraint(
        rolesAllowed = {"user", "admin"}
    ),
    httpMethodConstraints = {
        @HttpMethodConstraint(
            value = "DELETE",
            rolesAllowed = {"admin"}
        )
    }
)

This means:

• 👥 GET/POST: Users and admins allowed
• 🗑️ DELETE: Only admins allowed

📄 Method 2: web.xml Security

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Admin Area</web-resource-name>
        <url-pattern>/admin/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>

    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
</security-constraint>

<login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
        <form-login-page>/login.html</form-login-page>
        <form-error-page>/error.html</form-error-page>
    </form-login-config>
</login-config>

<security-role>
    <role-name>admin</role-name>
</security-role>

🔑 Authentication Methods

🎮 Method 3: Programmatic Security

Check permissions in your code:

protected void doGet(HttpServletRequest req,
                     HttpServletResponse resp) {

    // 👤 Who is logged in?
    String user = req.getRemoteUser();

    // 🎭 What role do they have?
    if (req.isUserInRole("admin")) {
        showAdminPanel();
    } else if (req.isUserInRole("user")) {
        showUserDashboard();
    } else {
        showLoginPage();
    }

    // 🔐 Get security details
    Principal principal = req.getUserPrincipal();
    if (principal != null) {
        String name = principal.getName();
    }
}

🔒 HTTPS Transport Security

Force secure connections:

In annotations:

@HttpConstraint(
    rolesAllowed = {"user"},
    transportGuarantee =
        TransportGuarantee.CONFIDENTIAL
)

In web.xml:

<user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>

🎓 Putting It All Together

Imagine a secure file upload system:

@WebServlet("/secure-upload")
@MultipartConfig(maxFileSize = 5000000)
@ServletSecurity(
    @HttpConstraint(
        rolesAllowed = {"user", "admin"},
        transportGuarantee =
            TransportGuarantee.CONFIDENTIAL
    )
)
public class SecureUploadServlet
        extends HttpServlet {

    protected void doPost(HttpServletRequest req,
                          HttpServletResponse resp)
            throws ServletException, IOException {

        // 🔐 Who's uploading?
        String user = req.getRemoteUser();

        // 📦 Get the file
        Part file = req.getPart("document");

        // 💾 Save with user folder
        String path = "/uploads/" + user + "/"
                    + file.getSubmittedFileName();
        file.write(path);

        resp.getWriter().write("Secure upload done!");
    }
}

🌟 Key Takeaways

graph TD
    A["Advanced Servlet Features"] --> B["Async Processing"]
    A --> C["File Upload"]
    A --> D["Security"]

    B --> B1[Don't block threads]
    B --> B2["Handle slow tasks"]
    B --> B3["Use AsyncContext"]

    C --> C1["Use @MultipartConfig"]
    C --> C2["Get Parts from request"]
    C --> C3["Set size limits"]

    D --> D1["Role-based access"]
    D --> D2["Authentication methods"]
    D --> D3["HTTPS enforcement"]

🎯 Remember These Golden Rules

🚀 You Did It!

You now understand the three superpowers of advanced servlets:

1. Async Processing 🏃 - Handle slow tasks without freezing
2. File Upload 📁 - Accept files from users safely
3. Security 🔐 - Control who can access what

Just like a well-run restaurant kitchen, your web application can now:

• ✅ Handle rush hour traffic
• ✅ Accept customer “ingredients” (files)
• ✅ Keep intruders out

Go build something awesome! 🎉