Raible Designs

The Battle of the GZip Filters

When I first added a Compression/GZip filter to AppFuse, I used the one from Roller, which I believe Lance found in this book. This has worked fairly well since I added it in July last year. When I discovered that there were issues with it on Resin, I chaulked it up as "no big deal" since I don't use Resin anyway. But yesterday, when I discovered that it stopped my apps from displaying my 403 <error-code> page, that was the last straw. I remembered seeing the "Two Servlet Filters Every Web Application Should Have" article on ONJava.com about a different implementation, so decided to download the source and try it out.

I quickly discovered that this Filter does work on Resin, so that's quite a bonus. I've had issues getting Roller to work on Resin with the Filter enabled, so I might have to replace Roller's CompressionFilter. However, I did still have to change a few things to convince this Filter to satisfy my needs.

Here are a few things I discovered about this GZIPFilter vs. Roller's CompressionFilter:

• Don't download the GZIPFilter from the article. There is a newer version of the code. Not much has changed, save for an almost completely re-written GZipResponseStream.java file. This one supposedly does better handling of large files.
• This Filter has the same problem I experienced with Roller's CompressionFilter: JSP pages don't finish rendering when running my Canoo WebTests. I'm assuming that this is because the buffer hasn't finished spitting out HTML. I ended up writing a new isGZIPSupported() method (in GZIPFilter.java) to do the check for GZip support. This allows my webtests to run smoothly by disabling the filter for HttpUnit.
• This Filter shares another issue that I found in the CompressionFilter yesterday. When my webapp returns an HttpServletResponse.SC_FORBIDDEN error code (from trying to access a method that denies the users role), the Filter suppresses the error and the user is not served up the 403 error page defined in my web.xml. To fix this, I overrode sendError() in GZIPResponseWrapper.java and added a check for this error code in the getWriter() method.

Overall, I'm pleased with this code because I love the concept of GZip Filtering, and now it's not causing any conflicts in my app or targeted appservers.

GZIPFilter.isGZIPSupported(HttpServletRequest):

GZIPResponseWrapper.sendError(int, java.lang.String):

GZIPResponseWrapper.getWriter():

Cactus and Form-Based Authentication

Quick Summary: Did you know it's possible to login (with form-based authentication) before running each of your testXX methods in a ServletTestCase or CactusStrutsTestCase? Just add a "begin" method in your Base class, or in each of your Tests, and it will be called automatically, just like setUp() is called.

    public void begin(WebRequest request) {
        request.setRedirectorName("ServletRedirectorSecure");
        request.setAuthentication(new FormAuthentication("tomcat","tomcat"));
    }

Long and Winded: Yesterday, I began adding the "roles" attribute to my Struts action-mappings - to limit access for certain user roles (Yes, XDoclet 1.2 supports this). This worked great in my web UI, until I tried to run my StrutsTestCases. Access was denied because I was not logged in. Rather, I was "faking it" by retrieving a UserForm object in my setUp() method and stuffing it into the session [View Source]. This worked like a charm until I added the roles restriction.

Cactus has a nice feature: if you write a beginXX method, it will be called before your testXX method. In other words, begin = client, test = server. So I added a number of beginEdit, beginSave, etc. method to my Action Tests. Great - everything worked. But it was ugly to add all those beginXX methods. Then, via Vincent Massol's wisdom, I learned of the global begin(WebRequest wr) method. Now I simply have a begin() method in my BaseStrutsTestCase class, and everything works as smooth as pie.

    public void begin(WebRequest request) {
        request.setRedirectorName("ServletRedirectorSecure");
        request.setAuthentication(new FormAuthentication("tomcat","tomcat"));
    }

A couple of issues I discovered:

• If you have an Action that doesn't have any roles in any of it's mappings, this will fail, so you have to override the begin() method with an empty {} method in your *Test.class. I believe the error message was it couldn't find the SecureServletRedirector.
• You must define all the roles (you plan to authenticate with) in your Ant build.xml file. [Read More]
• My <error-code>403<error-code> is not working on AppFuse or the current real-world app I'm working on. [Read More]

All in all, I'm pretty pumped that Cactus makes it this easy to test my app in its true production environment.

Later: I figured out the source of the 403 error-page not rendering. Once again, my Compression Filter does more harm than good. I switched it out for a more recent GZIPFilter and the same thing happens. The good news is that the new filter works on Resin, whereas the old one did not.

Hacked (Again)

This morning, a reader was kind enough to let me know that this website has been hacked.

The web pages at http://raibledesigns.com/tomcat/ with information about Apache, Tomcat and load balancing have been defaced.

I've contacted my sys admin and will hopefully get these files restored in the next few hours. I could do it myself, but I want to 1) see if this is a widespread problem (i.e. not just me) and 2) make sure all my defaced files are replaced. I got hacked a couple of months ago too, and I believe the same files were defaced. If it's another ISP issue, vs. someone logging in as me - it might be time to make the leap.

RE: My Predictions for MacWorld Announcements

I'm pumped that no super cool announcements came out of Steve's Keynote today. I dig that they've just enhanced my favorite Mac apps (iLife). If they would have announced new PowerBooks or cheaper displays, I could easily justify an upgrade... and my budget couldn't. So I say, "Thank you Apple. Thank you for not tempting me."

HowTo: Get an input field's value with Canoo's WebTest

I should start this by saying that I love Canoo's WebTest. It allows you to test clicking through your webapp as if you're using a browser. You simply write your tests in an XML file (which is really an Ant build file), and then run it with Ant. Usually, in my webapps, I write simple tests for CRUD on entities - i.e. EditUser (tests pulling up the edit screen), SavePosition (edit and save, verifies next screen's title), SearchUsers (verifies list screen's title).

One of the issues I had this morning was testing a wizard with WebTest. This was because I didn't know how to get the id of the new record after it was added. Now I found a way. Let's say you have a Create a Job wizard. On the first screen, you enter the job, and on the second, you add the required skills, on the third, you view a summary. To get the new id of the job, you can use XPath to get the hidden field named "jobId" - to do with what you may (i.e. click on a link to the third screen). Here's how: {{{ }}} This is especially helpful because I tend to use a lot of onclick handler's (with location.href's) on buttons (so I don't have to submit to the same action). I also turn off JavaScript for my tests - by not including js.jar in WebTest's classpath. I can't say enough about this tool - the ability to test your app, with JavaScript turned off, and verify that everything works... that's just cool. Especially when you're a JavaScript junkie like me.

My Predictions for MacWorld Announcements

Tomorrow is a big day for Mac enthusiasts. Steve Jobs will announce the next big things from Apple. I predict we'll get a $100 iPod (1000 songs), a 2.5 GHz Power Mac G5, and the one that'll blow everyone away - a 2 GHz PowerBook. I can dream, can't I? My 1.33g/1r PB easily feels 3x slower than my 2.6g/1.5r XP machine....

Honestly, the iPod and the PowerBook are the best Mac products - products that even PC owners gawk at. The $100 iPod is a must, the 2 GHz PowerBook will take the world by storm. My other fantasy is that the 23-incher's price drops to $1000...

[IDEA 4.0] Favorite Feature = Package View

My favorite feature of IDEA 4.0 is the package view. Since I keep my src and test trees separate, but their package structures identical, this is the view I've been longing for. Hopefully it's possible with Eclipse and I just haven't figured it out. What it does is allow me to see tests right next to my classes. In Eclipse, I have to constantly navigate between the two trees to edit tests and such.

Does this mean I like IDEA better than Eclipse? No, it simply means that I wish Eclipse had this feature, and I appreciate IDEA for adding it.

3° F

It was so cold this morning on the way to work, that when I sprayed the windshield with wiper fluid - it froze to the window and I couldn't see. Luckily, I was able to crank the defrost and only lost visibility for a few seconds. The car's thermometer read 3° F. My laptop's WeatherPop icon currently reads -1° F. Brrrrr...

Running AppFuse on Resin

Want to run AppFuse on Resin? I did some research (a.k.a. banging my head against the wall) and figured out how this morning. It isn't too tough, now that I've figured out how. You can read about my journey on my wiki, or follow the following steps (for the CVS version):

• Edit $RESIN_HOME/conf/resin.conf and add the following after the last </web-app> closing tag.

<resin:include href='appfuse.conf'/>

• Download appfuse.conf and put it in the $RESIN_HOME/conf directory.
• Put activation.jar, mail.jar and mysql-connector-java-3.0.9-stable-bin.jar in $RESIN_HOME/lib.
• Remove password encryption by changing the Login Servlet's encrypt-password init-param (in web.xml) to false. You can do this in the build process by changing "encrypt.password" to false in app-settings.xml. You could also do it from the command line using -Dencrypt.password=false. For testing, you will need to change a number of files that have the encrypted password. Search for "536c0b339345616c1b33caf454454d8b8a190d6c" and change it to "tomcat".
• Remove the <filter-mapping> for CompressionFilter.
• To enable the "Remember Me" feature, remove the <c:if test="${rememberMeEnabled}"> check in loginForm.jsp. (AppFuse 1.3-dev)

DISCLAIMER: I did not thoroughly test that everything works, I just ran through a couple of pages.

A little EL Lovin' for the DisplayTag

Tim McCune submitted a patch for the Display Tag Library to add Expression Language support. I committed it today, along with a few other enhancements. You can read more on the displaytag-devel mailing list. Tim's patch was a nice clean approach to adding EL support. He just subclassed the existing tags and then evaluated the expressions. All I did to integrate was to create an "el" package under "tags" and added an additional .tld file. So there's really nothing that's taken away from the original tag library, and if you want EL support, you simply need to use the "*-el.tld" in your web.xml or change your URI to "http://jakarta.apache.org/taglibs/display-el". Of course, you'll need to include JSTL's JARs (standard.jar and jstl.jar) in your WEB-INF/lib to make this work. This patch included the ability to specify a titleKey attribute - a much asked-for feature.

I like Tim's approach so much, I might have to use it for Struts Menu. It's a slick way of supporting JSP 1.1 containers, and adding optional EL support for JSP 1.2 containers. I haven't had any feedback from the dev team, but hopefully this will make it into the next release.