Matt RaibleMatt Raible is a writer with a passion for software. Connect with him on LinkedIn.

The Angular Mini-Book The Angular Mini-Book is a guide to getting started with Angular. You'll learn how to develop a bare-bones application, test it, and deploy it. Then you'll move on to adding Bootstrap, Angular Material, continuous integration, and authentication.

Spring Boot is a popular framework for building REST APIs. You'll learn how to integrate Angular with Spring Boot and use security best practices like HTTPS and a content security policy.

For book updates, follow @angular_book on Twitter.

The JHipster Mini-Book The JHipster Mini-Book is a guide to getting started with hip technologies today: Angular, Bootstrap, and Spring Boot. All of these frameworks are wrapped up in an easy-to-use project called JHipster.

This book shows you how to build an app with JHipster, and guides you through the plethora of tools, techniques and options you can use. Furthermore, it explains the UI and API building blocks so you understand the underpinnings of your great application.

For book updates, follow @jhipster-book on Twitter.

10+ YEARS


Over 10 years ago, I wrote my first blog post. Since then, I've authored books, had kids, traveled the world, found Trish and blogged about it all.
You searched this site for "form". 326 entries found.

You can also try this same search on Google.

iTerm, StrutsForm Generation and the Work Life

I found iTerm via a quick scan of posts on java.blogs. Very cool - I'll have to download it tonight.

I'm still working like a banshee as you might be able to tell from my lack of posting. I was up until 4 in the morning on Sunday trying to complete my struts-resume app for my Wrox Chapter (still not done). I've backed off from my attempts at generating Struts Forms and Hibernate classes from the same POJO. It just doesn't seem likes it's worth the effort. I'd still like to generate the initial stubs for these classes form a database, but I've come to realize that it's not practical to have these classes generated each time. It's just too much of a nightmare to mix and match what goes to Struts and what goes to a Hibernate class. I am going to give it one last college try though. I hope to use a POJO with XDoclet tags, and then modify the XDoclet code for StrutsForms so they can be produced from a POJO. Of course, if I were smart, I'd just finish the damn application the hard way and be done by tonight. Wrox would be much happier I'm sure. I'll try for 2 hours and if I can't get it, I'm done. I think that I'll end up generating the initial struts form and then stuffing it into the source tree for later manipulation. I've found that it's nice to add getter/setters to the form (that never make it to the backend), so this is probably the best way.

Things at the office are going well. I spent most of the day installing Tomcat, MySQL, VeryQuickWiki and Scarab on a Sun box. It was fun doing the ol' command line thing all day and OS X makes it a real pleasure to interact with Unix systems. Transmit2 makes it super easy to transfer files and even allows you to edit with BBEdit. It's worth the purchase for sure at $25.

I've decided (once again) that OS X is not the development environment for me. Eclipse is too flaky (I'm running 2.1 M4) and takes forever to do anything. Ant runs slow as hell, and Tomcat does too. I'm also addicted to Windows Exploder and OS X's Finder does nothing for me. So I told my boss that they were losing money if I didn't get a faster box, and Windows would probably be best. They said it didn't look good, so I volunteered to bring in my own machine (Dell 8100 P1.5, 768 MB RAM) if they could get me a new hard drive. By getting a hard drive, I don't have to blow out my Red Hat 8.0 installation and I can transfer the hard drive to the new machine when they finally get me one. So they found a 20 Gig hard drive and I'm building the machine as I hammer out struts-resume.

Posted in General at Dec 23 2002, 03:12:13 PM MST 1 Comment

New Job, Struts, Testing Frameworks and Maven

I found out this afternoon that they want me for the job I interviewed for yesterday. I'm expecting to start on Wednesday. It's a small team of 3 folks and should be a lot of fun. I'm really looking forward to getting back into an office environment where I can converse with co-workers and such. After blogging for the last few months, I feel like the java.blogs guys are my co-workers, but it's still fun to talk and interact with folks. I never used to like it - I'd bring my lunch to work everyday, and hunker down like a code monkey the whole time - just trying to get my 8 hours in and get outa there. I'd get annoyed when people would stop to talk about their weekend or other random stuff. Now I'm going to be that guy - I'd better watch for the telltale signs of get the hell out of my cube! I wonder if we'll even have cubes? The floor where my interview was had just cleared out a bunch of folks - it was empty when I went in there. When I say cleared out, you know what I mean. Needless to say, there is plenty of space and plenty of computers available -- it'll be interesting to see what I get.

My last project had horrible machines - NT4 Gateways with 4MB video cards and about 700 Mhz. And this was last year!! I had just bought a brand new Dell 8100 P4 1.5 Ghz 2 weeks before I started the gig - so you can imagine my disappointment. And I was running XP at the time, albeit a beta version. But still, I felt like I was taking a huge step back in time. So I brought in my own Windows 2000 CD on my 8th day on the job. It all looked to be going pretty smooth (and the install was about to finish around 7 a.m. - I got there at 5) when everyone started rolling in. The video drivers weren't compatible and I was forced to humbly call tech support and tell that how I had violated all the rules. This place at least has Windows 2000, and I have my Powerbook, so all should be good. I just hope I can get a dual monitor setup - there's nothing quite so enjoyable.

This evening I did some minimal development on AppFuse. I spent most of the day writing the Struts Chapter. I'm on page 12 and expect to do 10-20 more pages. It was fun writing because I described tools that make developing Struts apps easier: Ant, XDoclet, JUnit, StrutsTestCase, and Cactus among others. I dug in a little to the Testing frameworks and played with them, but nothing too serious. I can waste many hours coding and I need to finish writing, then code later. I used 2 very cool tools today. The first is Canoo's WebTest. It basically is a framework built on top of HttpUnit that allows you to write all your tests as Ant tasks. It's fricken sweet as you don't have to really write any code, and it just worked for me. Check out this file (XML) to see how easy it is.

The 2nd tool was written by Erik Hatcher to generate JSPs and a resource bundle based on a Struts ActionForm. I hadn't tried it out until tonight and it just worked - my favorite feature in any software. The one area I think I might run into issues (in generating all this code), is when I have ArrayLists of beans on a form. I think Hibernate will allow this using Sets, Lists and other types of Collections, but I'm doubting that XDoclet's strutsform task will support it and I don't think Erik's too; generates nested tag libraries or anything like that. This is unfortunate because I'll probably get a wild hair up my you-know-what and want to create this functionality. And there goes my deadline, right out the window. Need.... to ... stay ... focused..!

Lastly, I made an attempt to mavenize AppFuse. It was pretty easy at first, as you're only required to alter this XML file to fit your project's needs. I realized I didn't have much as far as a CVS repository, mailing lists, etc., but I also realized that these would be almost essential to any project. And they'd certainly make things a lot simpler - even on a small team. When I got to the dependency section (which is what I really need), I sorta gave up. Here's my dependencies and their presence at the Maven Repository:

So while Maven looks great, it doesn't offer all the third-party jars I need. Is it possible to partially integrate? Also, I found the documentation to be a bit lacking on how exactly to configure each dependency. Is there a standard naming convention or versioning to rely on? It'd be great to have a list and possible versions - or even XML fragments you can copy/past. Can we, as developers, contribute nightly builds to the repository? I'd love to use both AppFuse and Maven at my new project, but I hate waiting on things to happen. If I can do anything to make the above modules/versions present in Maven, let me know.

Posted in Java at Dec 13 2002, 06:23:07 PM MST 1 Comment

E-Mail Notification of Comments

I requested a new feature today for Roller - the ability to receive e-mail notification when comments have been posted. I mentioned this wouldn't be too hard using the mailer tag library. So I got slightly motivated and did it myself. I think to add it to Roller, we should make it a little more configurable, but here's what I added above the form in weblog/comment-form.jspf:

... define mailer and c taglibs of course ...

<c:if test="$\{param.method == 'update'\}">
    <mt:mail server="smtp.domain.com">
        <mt:setrecipient type="to">[email protected]</mt:setrecipient>
        <mt:from><c:out value="${param.email}"/></mt:from>
        <mt:subject>Comment: <bean:write name="blogEntry" 
property="title" scope="request" /></mt:subject>
        <mt:message><c:out value="${param.content}"/>

<c:out value="${param.name}"/>
<c:out value="${param.url}"/>
        </mt:message>
        <mt:send>
            Doh! An error has occurred sending comments notification!<br />
            <mt:error id="err">
                <jsp:getProperty name="err" property="error"/>
            </mt:error>
        </mt:send>
    </mt:mail>
</c:if>

I had to put those \'s in their in order to get past Velocity. The one pain with the mailer tag library is everything comes through with the spacing as set in the JSP. That's why the name and url variables are squished all the way over to the left.

Posted in Java at Dec 13 2002, 07:21:56 AM MST 2 Comments

Eclipse Plugins and Hibernate

I found a new site with a list of Eclipse plugins tonight. I was hoping that the Ant View plugin could solve my Ant problems in Eclipse, but I can't seem to figure out what it does. I gave it the ol' 30 seconds of investigation - maybe I should read the documentation. The problem I'm having now is (after swapping Ant 1.4 jars for 1.5.1) is:

Unable to find a javac compiler;
com.sun.tools.javac.Main is not on the classpath.

Hmmm, works fine from Cygwin, and Eclipse (2.0.2) has tools.jar and rt.jar in the classpath. Must be time to download a nightly build.

There was a lot of talk today in the java.blogs community about Hibernate. I'm happy to see this as it feels like I just bought a new car and everyone is saying it's the best car on the road. I decided to use Hibernate based on Dave's implementation in Ag. It looked easy enough, so I figured - why not?! It turns out, at the same time, that the XDoclet folks were in the midst of creating a new hibernate module in CVS. In fact, I got the hibernate module from Joel Rosi-Schwartz (I'm assuming a hibernate developer) before it was even in the XDoclet source tree.

I got to be a guinea pig in making hibernate tags work with XDoclet. I have to say that with Dave's working example, I was able to markup a POJO with hibernate/xdoclet tags and generate my persistence layer in a matter of minutes. It just worked. Kinda like Tomcat IMHO. That's how software should be. Check out my security-example if you're interested in using Hibernate with XDoclet. The readme in the source will explain how to run initial generation and tests. Currently, it generates a Struts Validator Form and VO from an Entity bean (located at src/ejb/org/apache/template/User.java). Why? Because Struts Forms can only be generated from Entity Beans. This needs to change IMO. But at the same time, the EJB architecture is already in place, I just need to execute the ejb-related tasks, and I'm in business.

In other news, a couple of Struts related goodies:

  • ONJava.com has an introduction to the Validator Framework by Chuck Cavanass, an Introduction to Eclipse and Creating Reports with FOP. I used FOP on a project last year around this time and it's super slick. It's basically using XSL to generate PDF and RTF from an XML file. I highly recommend using something like RTF2FO to generate an XSL Template from a Word document.
  • Struts Kick Start is now shipping from Amazon. I'd buy all the Struts books just to say you have them. I've got three ;) Haven't read any. Damn, I wish I had the time! Reading Erik Hatcher's Java Development with Ant was one of the smartest things I did this year. Actually, the smartest thing I did was get my wife pregnant yeah baby
  • I downloaded TogetherSoft's Control Center to do some UML Modeling for the Struts Chapter, and found that they use Struts on their site. Nice...

Posted in Java at Dec 12 2002, 05:37:04 PM MST 22 Comments

XML Encryption/Decryption

Erik gives us the heads up on a new W3C Proposal: an XML Encryption, Decription Standards. Just after I finished my first draft of my chapter on Security!! Arghh! Oh well, I'm sure there will be a 2nd and 3rd draft. I'll have to read this article and see if it's relevant. The first draft was due Sunday, I turned it in yesterday. It is supposed to include a sample application, and I'm still working on it.

I was up until 5 a.m. this morning working on it. I got Hibernate working nicely, and I can generate my Hibernate persistence layer and my Struts (validator) forms using xdoclet. Cool stuff, I did have to write the business tier to talk to hibernate, and I did have to write a Hibernate class (DAO) to talk to the persistence layer. Not as easy and clean as I'd hoped for, but now that the groundwork is laid, it'll probably be easier to move forward. It's pretty sweet that I can add a getter/setter to my POJO (actually it's an entity bean since that's the only way to generate struts forms using xdoclet) and I get a new column in the database and in both my VO (hibernate uses this) and my Form.

Posted in Java at Dec 10 2002, 09:14:51 AM MST Add a Comment

Form-based auth - getting the original URL

Lance suggested a while back that I try Roller's BreadCrumbFilter to get the originally requested URL for form-based authentication. The idea is that if you can get this URL, you can use it to login again on your form-login-error page. So I added BreadCrumbFilter.java to my security project and mapped it to /*. The value I'm hoping to grab is a URL to welcome.do, since that is where I route users when the hit the welcome page. I found that this filter never gives me welcome.do, but that request.getHeader("referer"); gives it to me just fine - but only in IE. Yeck. I guess Craig was right when he said that you can't reliably get the original URL. I guess you can always just hard-code the action in your form-error-page to go to your main menu. That is, if your app server doesn't support the same page thing.

Posted in General at Dec 06 2002, 09:46:18 AM MST 3 Comments

Using one JSP for form-based authentication

I'm writing about how to use the same login/error page with form-based authentication. Does anyone know which servlet containers this fails on? I guess it wouldn't hurt to know which ones it works on too. You can use this security.war (1.7MB) file to test. Since it's testing the failure page, you don't need to setup a user - but if you want, the role is tomcat. I know this works on Tomcat, so no need to test it.

Posted in General at Dec 05 2002, 10:27:20 AM MST 6 Comments

Using JAAS and making it switchable

Erik Hatcher has convinced me that I need to give more coverage to JAAS in my chapter on Security. To quote his comment from yesterday's JAAS post:

I think you are underestimating the value of JAAS a fair bit. Suppose you want to authenticate your users against a database table of users/passwords. Without JAAS this is container-specific (sure it works nice in Tomcat, but would you be able to do FORM authentication in WebSphere easily?). We use JAAS in the big application I'm developing and it gives us the freedom to more easily port our application to other containers. What if your application needed to authenticate users (suppose for a portal, not that far fetched, eh?) where each "portlet" had a different authentication scheme: LDAP, Windows NT, database, etc. JAAS is the way to go.

While I can see Erik's point, I think that if the app servers follow the Servlet spec, implementing form-based authentication on any J2EE-compliant server should be easy. After all, Tomcat is the Reference Implementation. At the same time, the bit about the portles is a whole other can of worms - I can see what he's getting at, and I guess I need to figure out an easy way to demonstrate using JAAS. From what I understand, you do have to call the authenticate() in a servlet or filter. Hopefully, I can use a little Ant/XDoclet magic to create a sample that can switch b/w form-based, container-managed authentication and JAAS. Tell me what you think of this idea:

  • Use Ant and a task that runs if ${enable.jaas} is true
  • This task (i.e. jaas) will add a JAAS policy file to the webapp, maybe in the WEB-INF/classes directory so it's in the classpath
  • The jaas task will do some token replacement in login.jsp to change the form's action from j_security_check to something else. Ideally, I wouldn't have to do this.
  • The webdoclet task with not merge the web-security.xml file into web.xml
  • The ActionFilter, which I currently use to retrieve the user's information, will call the authenticate method and route appropriately if JAAS is enabled.

One thing I really like about form-based authentication (besides the ease of setup and no required programming) is that it allows users to bookmark pages in your app. When they select that bookmark again after logging out, they are prompted for a login and routed to the bookmark upon successful authentication. I hope JAAS can do this too.

Posted in General at Dec 05 2002, 04:22:22 AM MST 5 Comments

Day 2 of Writing: Security Chapter

I need a good article or book to quote regarding HTTPS versus HTTP performance. I know that HTTPS is slower than HTTP, but I'd like some hard numbers if any of your fellas know of any. Today's been interesting, I feel like I've been writing all day, but I've only managed to get about 3-4 pages done. Damn...

The frustrating part is that I have to qualify everything and remember back to when I first started messing with security in web applications, when I first configured SSL in Tomcat, when I first tried to get form-based authentication on iPlanet (what a CF that was)! I'm hoping the audience for this book is fairly J2EE-fluent, but I feel that there are probably going to be a fair amount of newbies as well. It'd be interesting to write a book for the java.bloggers community. I could skip half the fluff and get right to the stuff - the actual code!

Oh well, tomorrow should be better, I'll be adding/verifying code examples, and divulging all the cool tricks I've learned over the years. I've been doing all this authoring on OS X, and I have to say it's been an enjoyable experience. iTunes cranked, a set of nice Sony (MDR-V600) headphones and enough caffeine (not to mention deadline-adrenaline) to stunt Abbie's growth.

Posted in The Web at Dec 04 2002, 01:29:08 PM MST Add a Comment

JAAS vs. Container-Managed Security

I'm digging into JAAS this afternoon as I enjoy the vacancy of the Winter Break at DU's Penrose Library. Man, what a great school - I used to love it when we'd get off 6 weeks for Christmas Break - from Thanksgiving through January - how sweet is that!?

The reason I'm writing on this cold (32°F) afternon is to get some thoughts on JAAS in web applications. I'm giving it about a paragraph of coverage, explaining that it's mainly for declaring authentication and authorization in policy files. Furthermore, it's only invoked when running your application (or Tomcat) with a security manager. However, it's not really needed in web applications because 1) container-managed/web.xml is good enough, and 2) authentication mechanisms never really need to be that fine-grained. Whaddya think? Am I wrong, does it deserve more coverage? Don't most app servers use JAAS under the covers?

Posted in General at Dec 04 2002, 10:19:06 AM MST 8 Comments