Detect the URI encoding automatically in Tomcat

The complicated way to achieve my goal was indeed to write my own javax.servlet.Filter and to embed it into the filter chain. This solution complies with the Apache Tomcat suggestion provided in Tomcat Wiki – Character Encoding Issues. Update (2010-07-31): The first version of this filter interpreted the query string itself, which was a bad … Read more

Differences between ServletResponse and HttpServletResponseWrapper?

BalusC’s answer is good, but it might be a little overwhelming if you’re just starting out. Put simply: SerlvetResponse and its extension, HttpServletResponse, are interfaces telling you what methods are available to call to do the things you need. In the normal course of working with Filters, Servlets, et al., you’ll use HttpServletResponse often to … Read more

Add a Servlet Filter in a Spring Boot application

When using Spring Boot As mentioned in the reference documentation, the only step needed is to declare that filter as a Bean in a configuration class, that’s it! @Configuration public class WebConfig { @Bean public Filter shallowEtagHeaderFilter() { return new ShallowEtagHeaderFilter(); } } When using Spring MVC You’re probably already extending a WebApplicationInitializer. If not, … Read more

Is doFilter() executed before or after the Servlet’s work is done?

The filter chain in essence wraps the servlet invocation. The chain will process all links until it hits the “bottom”, then allow the servlet to run, and then return up the chain in reverse. For example, if you have a new “example filter”, your doFilter() method may look like this: public void doFilter(ServletRequest request, ServletResponse … Read more

Authenticating the username, password by using filters in Java (contacting with database)

String sql=”select * from reg where username=””+user+”” and pass=””+pwd+”””; This is an extremely bad practice. This approach requires that both username and password being passed around plain vanilla through requests. Moreover, you’ve there a SQL injection attack hole. Make use of sessions, in JSP/Servlet there you have the HttpSession for. There is really also no … Read more

How to use HttpServletRequest#getParts() in a servlet filter running on Tomcat?

In order to get HttpServletRequest#getParts() to work in a Filter in Tomcat, you need to set allowCasualMultipartParsing=”true” in the webapp’s <Context> element in Webapp/META-INF/context.xml or Tomcat/conf/server.xml. <Context … allowCasualMultipartParsing=”true”> Because as per the servlet 3.0 specification the HttpServletRequest#getParts() should only be available inside a HttpServlet with the @MultipartConfig annotation. See also the documentation of the … Read more

ContentCachingResponseWrapper Produces Empty Response

After couple of hours of struggling, I’ve finally found the solution. In short, ContentCachingResponseWrapper.copyBodyToResponse() should be called in the end of the filter method. ContentCachingResponseWrapper caches the response body by reading it from response output stream. So, the stream becomes empty. To write response back to the output stream ContentCachingResponseWrapper.copyBodyToResponse() should be used.