Re: redirecting from a servlet to an exterior URL using a POST

Chris - I'm not familiar with javax.servlet.RequestDispatcher.redirect -
What version of servlets provides that method? There is a sendRedirect
method on the response object.

Garey - Yes we all agree that redirect will not do a POST.  The various suggestions that have been made all work, including using a programmatic post with Jakarta HttpClient.  One thing to be aware of is that POST is NOT a security mechanism. Even though the parameters do not show on the URL as with a GET, it is still fairly easy to see these values with a POST for someone who goes to a little trouble.  So if you have a security reason for this question your premise was not correct. Still, the HttpClient or HttpURLConnection approaches seem like they will do what you are trying to do.

BTW - I'm tempted to wonder - if anyone can use your system to login to the other system you might as well make a guest password public anyway!


Paul Copeland
JOT Servlets Web Component Framework
http://www.jotobjects.com

>------------------------------
>
>Date:    Wed, 22 Jun 2005 17:37:20 -0700
>From:    Chris Pratt <[email protected]>
>Subject: Re: redirecting from a servlet to an exterior URL using a POST
>
>True redirection in the HTTP sense is not possible with a POST request, but
>that does not mean that you can't accomplish the same end result.  There are
>two options, depending on where you want to "redirect" to.
>
>First, some insight.  An HTTP redirect is nothing more than a response to an
>HTTP request that contains a 3xx return code and a location header.  Almost
>every browser out there should respond to that return code by submitting a
>GET or HEAD request to the URL specified in the location header (whichever
>was used in the original request).  If necessary, the value of the location
>header can contain query parameters.
>
>That is the mechanism that web designers use to accomplish many "tricks".
>It's useful once processing of a form request is completed, to redirect the
>user to a page designed to display the results of the form processing.  It
>can also be used to forward people that come to your old address to a new
>address (kind of like the Post Office forwards your mail to you when you
>move).
>
>On to the options:
>
>1)  If you want to redirect to another page in your web application, you can
>use the javax.servlet.RequestDispatcher.redirect() method.  This redirection
>never actually goes back to the browser, it just internally forward the
>request (with any attributes you define) to the Servlet/JSP that is
>responsible for processing that page in your web application.  The URL bar
>on the user's browser will still contain the request as it was passed to the
>original Servlet/JSP.
>
>2)  Perform your own HTTP request and stream the results back to the
>browser.  This sounds harder than it is.  Basically you create a
>java.net.HttpURLConnection with the URL of the web site you want to
>"redirect" to.  This can actually contain the query parameters (as long as
>they're not too large) since it will never be sent to the user's browser
>either and will not appear in the browser URL bar.  Open the connection, get
>the content and write it to the Servlet's OutputStream.
>
>Hope this helps.
>  (*Chris*)
>
>-----Original Message-----
>From: A mailing list for discussion about Sun Microsystem's Java Servlet API
>Technology. [mailto:[email protected]] On Behalf Of Garey Mills
>Sent: Wednesday, June 22, 2005 8:33 am
>To: [email protected]
>Subject: Re: [SERVLET-INTEREST] redirecting from a servlet to an exterior
>URL using a POST
>
>Paul -
>
>        Thank you for your response. After posting this question, I took a
>look at RFC 2616 and found this:
>
>        10.3 Redirection 3xx
>This class of status code indicates that further action needs to be taken
>by the user agent in order to fulfill the request.
>The action required MAY be carried out by the user agent without
>interaction with the user if and only if the method
>used in the second request is GET or HEAD.
>
>
>        My reading of that is that redirection with a POST can't be done.
>Am I reading it wrong?
>
>
>
>
>>If you really want to do a POST take a look at Jakarta HttpClient for a
>>start.
>>
>>http://jakarta.apache.org/commons/httpclient/3.0/index.html
>>
>>
>
>        My situation is exactly this. I have provide an authentication
>step for users accessing a resource the university pays for. The
>university has a password and user name that should not be exposed to the
>end user. I have an authentication facility that I pass a URL (to a
>servlet) to be
>connected to once the end user is authenticated. What I would like is to
>be able to formulate a POST request in the servlet and then foward the
>end user to it.
>
>        It sounds to me that you are suggesting that in the servlet I
>should open an HTTP connection to the resource and read out the resulting
>page as though it were the servlet's response. I'm going to try that,
>though I can imagine various things going wrong.
>
>Thanks again for the help;
>
>Garey Mills
>Library Systems Office
>UC Berkeley
>
>The brain is not where you think
>
>On Wed, 22 Jun 2005, Paul Copeland wrote:
>
>
>
>>Probably RequestDispacther.forward won't do what you want unless the
>>external URL is in the same ServletContext or at least on the same server.
>>
>>If you have control of the other end you might forward with a
>>java.net.HttpURLConnection and just write into the OutputStream on one
>>end and read on the other end with ServletRequest.getReader(). Or even
>>sending a serialized object...
>>
>>If you really want to do a POST take a look at Jakarta HttpClient for a
>>start.
>>
>>http://jakarta.apache.org/commons/httpclient/3.0/index.html
>>
>>Paul Copeland
>>JOT Servlets Web Component Framework
>>http://www.jotobjects.com
>>
>>
>>
>>>------------------------------
>>>
>>>Date:    Wed, 22 Jun 2005 10:19:28 +0800
>>>From:    Sreenath <[email protected]>
>>>Subject: Re: redirecting from a servlet to an exterior URL using a POST
>>>
>>>Hi Gary
>>>
>>> As long as u use requestDispacther.forward("")(Instead of redirect) ,
>>>the URL won't be visible .rather ur servlet URL will be visible in the
>>>address bar . So as long as URL is not visible GET and POST shouldn $B!G
>>>
>>>
>(Bt
>
>
>>>make any difference until unless u r sending some multi-form data
>>>
>>>
>>>
>>>-----Original Message-----
>>>From: A mailing list for discussion about Sun Microsystem's Java Servlet
>>>API Technology. [mailto:[email protected]] On Behalf Of
>>>Garey Mills
>>>Sent: 2005 $BG/ (B6 $B7n (B22 $BF| (B 0:21
>>>To: [email protected]
>>>Subject: redirecting from a servlet to an exterior URL using a POST
>>>
>>>Hello -
>>>
>>>       Once a servlet I am writing is accessed, I want to set the
>>>values
>>>on several parameters and then redirect to an exterior URL, sending
>>>along
>>>the parameters. But I do not want the parameters exposed, so putting
>>>them
>>>into the URL as a query string won't work, I need a POST.
>>>
>>>       Has anybody done this?
>>>
>>>Garey Mills
>>>Library Systems Office
>>>UC Berkeley
>>>
>>>
>>>
>>>
>>>
>
>

___________________________________________________________________________
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff SERVLET-INTEREST".

Archives: http://archives.java.sun.com/archives/servlet-interest.html
Resources: http://java.sun.com/products/servlet/external-resources.html
LISTSERV Help: http://www.lsoft.com/manuals/user/user.html