2

I am trying to upload a file(log file) from an applet, running in a browser. I am reading the file in a String. Following function, given a String data and a string URL (e.g: http://192.168.0.166:8380/app/customer/UploadData.do), uploads the data to a URL. Since, after a timeout, session with the server is lost. Therefore I am appending username and password with the URL, to avoid any session expire issue (since this uploading is supposed to be automatic, without any manual input etc.). The URL(not public) looks something like :

http://192.168.0.166:8380/app/customer/UploadData.do?username=uname&password=pword

public static void sendData(String aData, String aURL) throws Exception {
    try {
        byte[] myData = aData.getBytes();
        /* Uploading the data */
        URL myURL = new URL(aURL);
        HttpURLConnection myConnection = (HttpURLConnection) myURL.openConnection();
        myConnection.setDoOutput(true);
        myConnection.setUseCaches(false);
        myConnection.setDefaultUseCaches(false);
        myConnection.setRequestProperty("Content-type", "application/octet-stream");
        OutputStream myOutputStream = myConnection.getOutputStream();
        myOutputStream.write(myData);
        myOutputStream.flush();
        myOutputStream.close();

        int status = ((HttpURLConnection) myConnection).getResponseCode();

    } catch (Exception exception) {
        throw exception
    }
}

This function works absolutely fine as long as the session with the server is live. It doesn't work when for example the session is expired or user logs out( applet runs 24/7). Please note the the above URL works fine when accessed via web browser. Its this java code (applet) which isn't able connect again when the session expires. It would be of great help if anyone could point out what am I doing wrong here. Any help will be highly appreciated.

Environment: Jboss as application server and JBoss Secured Realm for login.

2
  • NO ANSWER. (This is not HTTP POST.) I had to think about the session cookie. Maybe you should first do a login separately, and use session cookie/url rewriting. setDoInput(false) cannot hurt.
    – Joop Eggen
    Nov 29, 2011 at 10:22
  • @Joop Eggen: Thanks for the correction, i updated the title.
    – Umer Hayat
    Nov 29, 2011 at 10:35

3 Answers 3

1

Does the web page you are querying accept logins and create a new session based on the username/password parameter you send?

If the user is logging in to the website via standard methods (e.g. a login page that they enter their details into in the browser) then that will create a cookie which is sent back and forth identifying them as the 'owner' of that session and authenticating them (until it times out). If they then run your applet then your applet will end up piggy-backing that session and cookie until it expires.

If it does expire your applet will need to do the same thing the user did to log in, most likely do a HTTP POST to a login page, unless the upload page specifically accepts the username and password and does not need a session or creates one then what you are trying will not work.

You can look at the login page for the form though and have your applet query that page, parsing the output HTTP headers for the cookie and passing it back in in the upload.

Failing that one simple solution might be to have your applet simply query the website regularly (once every hour or 20 minutes) to prevent the session timing out. It doesn't necessarily need to upload - it can query probably any restricted page.

1

The problem is in your server implementation, not in the client code. You should not be using session to identify a user when a client program is connected to server. It is more appropreate to use session in the web browser context.

You should use Basic Authentication method when you connect to your server from cilent program. This can be done by adding Authorization header to your uploading request and the server parse this to get username and password. It is slightly safer than puting the username and password in your url. There are other authentication methods and you might want to have a look.

8
  • Thanks for the response :). I am using Jboss as server and 'JBoss Secured Realm' for security. Login is managed by Jboss aswell.
    – Umer Hayat
    Nov 29, 2011 at 10:34
  • Then use the authentication method that match the realm you set.
    – gigadot
    Nov 29, 2011 at 10:38
  • Your session should be recreated by JBoss if you use the correct authentication method. Most server uses Basic Authentication since it is easy.
    – gigadot
    Nov 29, 2011 at 10:40
  • :As mentioned above, the same URL works absolutely fine if I access it using a web browser. In fact, its a requirement that the user should be able to log in directly if he provides username/password in the URL. I don't think there is an issue with realm.
    – Umer Hayat
    Nov 29, 2011 at 10:44
  • If that's the case then you have to find a walkaround. My answer here is just a suggestion of how to use the authentication and autorization correctly.
    – gigadot
    Nov 29, 2011 at 10:51
0

HttpClient might help here: a HTTP PUT.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.