Raible Designs

Jetty 6.x versus Tomcat 6.x

An AppFuse user asks:

Has anyone done any performance benchmarking between Jetty 6.x and Tomcat 6.x to see which one is better for production use in terms of scalability, performance and ease-of-use? I'm gearing towards Jetty 6.1 but want to hear other's opinions first.

I admit, I completely changed the wording in this quote to make it more readable.

Most of the companies I've worked with in recent years have been using Tomcat (very successfully) in production. However, I also know the Contegix and JavaLobby guys continue to swear by Resin for the most part. What's your opinion?

IMHO, I don't think it really matters - they're all good enough for production use.

AppFuse vs. Grails vs. Rails

In the comments of my Choosing a JVM Web Framework, Graeme Rocher writes:

no offense Matt, but I fear you are a grossly inappropriate person to be writing such a study given your past history of claiming frameworks like Grails are competitors to AppFuse. Any such study will come laced with doubts over its honesty and I'm sure this doesn't just apply to Grails.

In the post Graeme linked to, I said:

I think Grails and AppFuse are more likely competitors rather than compatible. Grails uses Spring, Spring MVC and Hibernate under-the-covers, whereas AppFuse uses the raw frameworks. Of course, it would be cool to allow different classes w/in AppFuse to be written in Groovy or JRuby. At this point, I think it's probably better for users to choose one or the other.

Since writing that post a year ago, I've changed my opinion about AppFuse being competitors with Grails or Rails. Why? Because they're different languages. I don't think you should choose a web development stack first. I think you should choose your language first. For those that choose raw Java, I think AppFuse provides a good solution. To be more explicit, here's a private conversation that David Whitehurst (author of The AppFuse Primer) and I exchanged.

David: Have you been looking at Ruby on Rails any? And, if so, I'm sure you're as impressed by those who command the language as I am. But, I think the J2EE web application is not dead yet. Do you think any comparison of the complexity of AppFuse vs. Rails should be mentioned in the book?

Matt: I'm highly aware of Rails, have attended talks and tutorials on it, even bought books about it - but I've never written an app, done a tutorial or used it in the real-world. I'm afraid of it. I'm almost certain I'd like it, and I'd likely like Grails as well. However, the reason I stick with pure Java is because that's where my clients' demand is and hence the consulting dollars for me.

It's probably also possible to create AppFuse for both Rails and Grails. I believe Rails' Streamlined in much like AppFuse. I like to think of AppFuse as language agnostic - it's always been designed to eliminate ramp up time. While Rails and Grails simplify the programming API and make it possible to develop code with less lines of code, it'd be nice to have user management, file upload and other things like AppFuse has. When I start using these frameworks, it's likely I'll develop some sort of features like AppFuse has and use them on projects. Of course, if they already have all the features of AppFuse via plugins, I wouldn't reinvent the wheel - I'm simply use what's already there and be happy about it.

I don't know if it's relevant to mention Rails, but it probably doesn't hurt. There's no reason to ignore the competition if they're indeed competition. I don't see them as competition, and I almost don't see Grails as competition either. AppFuse (in its current state) is for developers that've chosen to use the language and frameworks that AppFuse supports. It's not trying to solve everyone's problems - it's merely trying to simplify things for those using the frameworks it supports.

There's nothing saying that AppFuse can't have a Rails or Grails version in the future. For me, it'll happen if I start developing applications using these frameworks and see the integration needs like I saw with the Java frameworks. The good news is most of these frameworks have done the integration work, so it's really just a matter of creating features or using plugins.

David: I keep getting these "dream-squasher" friends of mine showing me Rails, Grails, and how wonderful Ruby is. It's impressive, but I'm not convinced that big business is ready to adopt it any time soon.

Matt: As a Java programmer, I think you'd be a fool to ignore Rails or Grails and not at least be familiar with them. There's no reason to discount technology until you've used it on a real-world project - at least 6 months or longer - IMO.

Just because you're productive in Ruby and like it - that doesn't make you a bad Java programmer.

I hope this clears up any confusion on how I feel towards Rails or Grails. I would welcome the opportunity to use them on a project. If I was starting a products-based company, I certainly would give them a shot in the prototyping phase. However, I'm a consultant that makes money from clients hiring me to explain/do what I know best. At the current time, that happens to be open source Java frameworks.

I do plan on learning a plethora of other frameworks, in other languages, I just haven't had the time yet. When I do, I hope that I can somehow become proficient enough to help companies adopt them as well. However, to build up that experience and expertise will likely take years. I think this is how lots of companies feel. Can you blame them for not "jumping ship" on their current skills and knowledge?

Of course, then you have the Relevance guys who seem to be doing exactly what I hope to be doing in several years from now. Not only do they specialize in Java and its frameworks, but they also do consulting and training around Rails, Grails and Ajax. I can't help but admire them tremendously.

Choosing a JVM Web Framework

I plan on rewriting my "Comparing Java Web Frameworks" presentation for this year's Colorado Software Summit. Rather than "Comparing Java Web Frameworks", I'm going to make it into more of a "Choosing a JVM Web Framework" presentation. I think this opens it up to more possibilities such as Grails, JRuby on Rails, Flex and GWT.

One of the things I hope to talk about is choosing the right tool for the job. I think there's 3 types of web applications you can develop:

1. Consumer-facing, high-traffic, stateless applications
2. Internal, more desktop-like applications that are stateful
3. Media-rich applications that require a RIA framework like Flex

Once you've decided on which of these you're developing, it's much easier to narrow down the choices:

1. Struts 2, Spring MVC, Stripes
2. JSF, Tapestry, Wicket
3. GWT, Flex, OpenLaszlo

I'm not sure if GWT fits in the RIA category. I'm not sure where Rails or Grails fit either. They more closely resemble category #1 than any other, yet there's a lot of speculation about their scalability. I think if that perception can be changed, they'll fit into the first category quite well. However, I don't think they compete with component-based or RIA because they don't hold state or offer rich-media capabilities.

Sidenote: I find the scalability debate quite interesting. There's a fair amount of propaganda in Javaland that scalability can be achieved with appservers and clustering tools like Terracotta. If this is true, I've yet to read good solid proof of it. Most of the "how to scale" information out there suggests "share nothing" architectures that shard data and applications across several servers. Of course, there's scalability and then there's massive scalability. Can appservers and clustering solve massive scalability like Google and Amazon require?

The 2nd and 3rd categories have someone of a blurry line, so I'm hoping to figure out how to clarify that. There's also a lot of other factors that will go into choosing a web framework. What if you're simply trying to replace a home-grown framework with an open-source one? If you want to keep your backend and all its logic, does it make sense to use something like Seam, Grails, JRuby on Rails or even AppFuse? Probably not - all their wizbang features and CRUD generation doesn't mean much if all you're using is the web framework. Also, if your application requires support for non-JavaScript browsers (for 508 compliance), then GWT and JSF can be easily eliminated. I know that there are many claims that JSF doesn't require JavaScript, but I've yet to see a real-world application developed with JSF that expects JavaScript to be turned off. Progressive enhancement is a requirement by many of my clients these days.

What's your opinion? How can we make it easier for developers and companies to choose a web framework? Is categorizing application types a good technique?

Trim Spaces in your JSP's HTML Redux

Since my last post on trimming whitespace in JSPs seems to be a popular topic, I figured it appropriate to note that JSP 2.1 supports a new trimWhitespace directive.

<%@ page trimDirectiveWhitespaces="true" %>

If you're using a Servlet 2.5 XSD, you can also do this in your web.xml:

    <jsp-config>
      <jsp-property-group>
        <url-pattern>*.jsp</url-pattern>
        <trim-directive-whitespaces>true</trim-directive-whitespaces>
      </jsp-property-group>
    </jsp-config>

A Servlet 2.5 XSD seems to be the following:

<web-app
    xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    metadata-complete="false"
    version="2.5">

To learn more about this feature, view Summary of New Features in JSP 2.1 Technology and search for "TrimWhiteSpace". It'd be nice if there was anchors in this article for a direct link, but I couldn't find any.

Now I just wish JSP's EL had an xmlEscape="true" flag to escape XML in printed variables. Freemarker supports this.

Hat tip to Kerem and Krishna's Unified Expression Language for JSP and JSF article.

Integrating Struts 2 + JSF + Facelets

What if you didn't have to choose between a request-based framework and a component-based framework? What if you could use them together and use request-based for some pages and component-based for others? This is the functionality that the Struts 2 JSF Plugin provides.

To be fair, the JSF-Spring project says it does the same thing for Spring MVC + JSF, but there doesn't appear to be any documentation.

I did some prototyping of Struts 2 + JSF and discovered that it does indeed work. I also discovered that there's no documentation on integrating it with Facelets. Luckily, it's pretty easy to do - hence my reason for writing this entry. You might ask why I want to use Facelets when JSF 1.2 supports JSP fairly well? My reason is because JSP 2.1 hijacks #{}, which Struts 2's OGNL uses for some expressions. Because of this, I want to be able to run on a JSP 2.0 container until a workaround comes along. Sun's JSF 1.2 RI can run on a JSP 2.0 container, while MyFaces 2.1 cannot (at least in my experience).

There's two ways to get Struts 2 + JSF + Facelets working:

• Create a WEB-INF/faces-config.xml file and override the default view-handler:

  <?xml version="1.0" encoding="UTF-8"?>
  <faces-config xmlns="http://java.sun.com/xml/ns/javaee"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
          http://java.sun.com/xml/ns/javaee/web-facesconfig_1_2.xsd"
      version="1.2">
  
      <application>
          <view-handler>com.sun.facelets.FaceletViewHandler</view-handler>
      </application>
  </faces-config> 
  

• The 2nd way is to use Ajax4JSF and declare the view-handler in your web.xml (allowing you to get rid of faces-config.xml):

  <context-param>
      <param-name>org.ajax4jsf.VIEW_HANDLERS</param-name>
      <param-value>com.sun.facelets.FaceletViewHandler</param-value>
  </context-param>
  

NOTE: You have to use 2nd method if you want to use Ajax4JSF. It won't read the view-handler from faces-config.xml.

If you're using SiteMesh, you may have to add another <parser> element to your sitemesh.xml to get Facelets pages decorated:

<parser content-type="application/xhtml+xml"
    class="com.opensymphony.module.sitemesh.parser.HTMLPageParser"/> 

Thanks to Laurie Harper for his assistance figuring this stuff out.

Now you might ask - why would you want to do this? For one, Struts 2 has a better navigation model (IMO) than JSF. Also, if developers want to use JSF and think it's a better way for a certain module - let them go to it!

OSCON 2007: Comparing Java Web Frameworks

This afternoon I delivered my Comparing Java Web Frameworks talk at OSCON in Portland. I told attendees I'd post it here afterwards, so here it is:Download Comparing Java Web Frameworks Presentation (5.1 MB)

For comments on this presentation from earlier this year, see related postings from ApacheCon EU and JA-SIG. This presentation is pretty much the same as the one from ApacheCon and JA-SIG, except it has a different theme and I chopped out the Sweetspots section (due to time constraints).

Portland is great this time of year, but unfortunately I won't be sticking around. I'm heading down to Salem to work remotely for a couple of days, returning for the Oregon Brewers Festival on Friday and heading back to Denver on Saturday. I'll be glad when July is over - I've traveled to a new state every week.

Java Web Frameworks and XSS

In preparation for my talk at OSCON next week, I've been doing some research on cross-site scripting and how good Java web frameworks handle it. I'm disappointed to report that the handling of XSS in Java web frameworks is abysmal. First of all, the JSP EL doesn't bother to handle XSS:

With JSP 2.0 you can use the following to emit the description of a "todo" item:
${todo.description}
That's pretty nice. What happens when someone has entered a description like this?
<script type="text/javascript">alert('F#$@ you!');</script>
Well, it executes the JavaScript and pops up a nice little message to you.
...
My question is this: Why in the world did the expert group on the JSP 2.0 JSR decide to make not escaping XML content the default for EL expressions, when they made the opposite decision for c:out?

(Emphasis mine) If a company/developer wants to make sure their JSP-based code is not susceptible to XSS, they have two choices (as I see it):

• Do lots of code review to make sure <c:out> is used instead of ${}.
• Hack the jsp-compiler/el-engine to escape XML by default.

The good news is #2 doesn't seem to be that hard. I pulled down commons-el yesterday, added a hack to escape XML, re-jarred and put it in Tomcat 5.0.25's classpath. This actually worked and I was impressed it was so easy. However, when I looked at Tomcat 6, commons-el is no longer used and now there's a "jasper-el.jar" in the lib directory. I don't mind modifying another library, but what's the difference between jasper-el and commons-el?

Of course, the whole problem with JSP EL could be solved if Tomcat (and other containers) would allow a flag to turn on XML escaping by default. IMO, it's badly needed to make JSP-based webapps safe from XSS.

On a related note, there's a couple of web frameworks that I've found to be susceptible to XSS: namely Spring MVC and Struts 2. For Spring MVC, its <form:input> and <form:errors> tags are vulnerable. For Struts 2, OGNL expressions are evaluated, which is way worse than XSS and actually allows you to shutdown the JVM by putting %{@java.lang.System@exit(0)}" in a text field.

Even though it was surprising for me to see the issues with Struts 2 and Spring MVC, I'm somewhat glad they exist. If I hadn't discovered them, I might blissfully think that Java web frameworks aren't susceptible to XSS. However, it appears they're not only susceptible, but no one is really thinking about XSS when developing these framework. To further prove that theory, the Spring MVC and Struts 2 teams are aware of these issues, have been for quite some time - yet they've done nothing in the form of releasing upgrades or patches.

Seems kinda strange doesn't it?

New Bike - Gary Fisher HiFi Plus

It's been a little over 2 years since my mountain bike got stolen. I bought a new bike a few weeks later, but it's a commuter, not a mountain bike. Today, I finally bought myself a new mountain bike and took it straight to 3 Sisters for a nice ride. My last bike was a Gary Fisher Sugar 3, and this one is a Gary Fisher HiFi Plus. It's awesome to ride and I can't wait to take it some more of the front range trails. Denver has some incredible trails in the foothills. They're not easy, but they sure are fun. This week, I hope to ride Apex, Deer Creek Canyon and White Ranch.

Wicket Graduates

From the Wicket user mailing list:

We have Graduation! Apache Wicket is established as a top level project within the Apache Software Foundation.

Congratulations to the most enthusiastic and passionate web framework development team in Javaland!

Webinar on Wednesday: Introduction to Apache Roller

If you're not doing anything this Wednesday, you might want to checkout my Introduction to Apache Roller Webinar. It's sponsored by Covalent and has the following agenda:

11:00: Introductions
11:05: What is Apache Roller 
11:10: Installing Roller
11:20: Roller Architecture
   - 11:25: Blog Customization
   - 11:35: Server Customization
11:40: Other Features: Using Weblog Clients and Planet
11:50: Q & A

Heck, even if you are doing something, you should still check it out - especially if you're planning on installing Roller for yourself or for your company. Here's the details and how to signup:

To register, click here and follow the provided steps.

About Covalent and Roller
Covalent recently announced it is offering full commercial support for Apache Roller, the open source blog server from the Apache Software Foundation (ASF). Apache Roller drives the Covalent blog, Sun Microsystem's blogs.sun.com blogging site, IBM DeveloperWorks blogs, the Javalobby's 10,000 user strong JRoller Java community site, and hundreds of other blogs world-wide. Roller is a Java Web application that is run on any Java EE server and any relational database.

<Sidenote/>
I think it's important to point out that JRoller and Roller are not the same thing. JRoller is a service provided by JavaLobby that provides free blogs, whereas Roller is the software that powers it. There's been a lot of negative press about JRoller in recent months and from talking to folks, it sounds like most of it is well-deserved. The service is down a fair amount and when it's up, it's extremely slow.

The good news is these problems should go away in the near future. From Matthew Schmidt in a recent JavaLobby Newsletter:

DZone Network Server Upgrades Coming
Over the weekend, Rick and I started the long and painful process of finally upgrading our three-year-old servers to some hardware that should let us scale and meet the needs of the network for the foreseeable future. With these new servers, comes some upgrades that many of you have been trying to beat into my head for months now, including an upgrade to a recent a version of Roller (powers JRoller) as I can find, and an upgrade to the latest and greatest Codebeamer (powers JavaForge). In addition, there's also going to be a much-needed make over to Javalobby and EclipseZone. Of course, these changes won't happen immediately and we'll be migrating to the new hardware first, but keep your eyes open for some nice updates to nearly all our communities. These upgrades have already started and we'd appreciate any feedback you have on whether things like Javalobby and EclipseZone are working properly. Drop me a line if you notice anything not working properly or feeling slow.

IMO, JavaLobby has been mostly mute about its stance on JRoller, and I've heard from folks there's virtually no support. My guess is this is because they've been concentrating on DZone so much. Maybe they need some volunteers to make JRoller more robust? Or maybe it should be moved to other servers that can make money off the service and re-invest it (like wordpress.com)? Hopefully nothing has to change and JRoller can become a higher priority for JavaLobby in the near future.

Update: The webinar went quite well - thanks to everyone who attended! You can download the PowerPoint (or PDF) and audio from Covalent's Webinars. Also, I mentioned a couple of Dave's presentations in my talk. You can download those by clicking on the links below:

• Roller: An Open Source Java EE Blogging Platform
• Roller and blogs as a web development platform