Back to Servlet Hub

Nearby lessons

24 of 34
Servlet - Web SecurityServlet - Declarative SecurityServlet - Programmatic SecurityServlet - Questions & AnswersServlet - MCQ Quiz

Servlet - Programmatic Security

📌 What You Will Learn
  • Understand Programmatic Security
  • Understand Demo Program for programmatic Security
  • See complete working code examples

Programmatic Security is an essential part of the Java Servlet technology. This lesson explains Programmatic Security, Demo Program for programmatic Security and FirstServlet.java with complete, runnable code examples, clear step-by-step explanations, and common mistakes to avoid.

Programmatic Security

Sometimes declarative security is not enough, compulsory we should go for programmatic

security.

Based on the user role, we have to provide the corresponding response. If the user is admin then

admin related response and if the user is manager then manager related response we have to

provide.

For this type of requirement compulsory we should go for Programmatic Security.

We can implement programmatic security by using the following methods of HttpServletRequest.

Programmatic Security

If the authenticated user belongs to the specified role then this method returns "true"

If the authenticated user not belongs to the specified role or if the user not authenticated then

this method returns false.

Example02
JCode Cell
1 
2public boolean isUserInRole(String rolename)
3

Programmatic Security

Returns the authenticated user name(login name)

If the user has not been authenticated then this method returns null.

Example03
JCode Cell
1 
2public String getRemoteUser()
3

Programmatic Security

Returns java.security.Principal object which contains user name.

Returns null if the user has not been authenticated.

Eg:

Example04
JCode Cell
1 
2public Principal getUserPrincipal()
3

Programmatic Security

The main problem in this approach is we are hard coding the role names in the servlet.

If there is any change in the role-name, modifying servlet code is costly and creates maintanence

problems.

To overcome this problem we have to use <security-role-ref> tag. By using this tag we can map

hard coded role names with original role name.

Example05
JCode Cell
1 
2if(req.isUserInRole("admin"))
3{
4out.println("Admin related response");
5}
6else
7{
8out.println("non admin related response");
9}
10
Output

Admin related response

Programmatic Security

where admin is logical role name and durgaadmin is original role name.

Example06
JCode Cell
1 
2<servlet>
3.....
4<security-role-ref>
5<role-name>admin</role-name>
6<role-link>durgaadmin</role-link>
7</security-role-ref>
8</servlet>
9

Demo Program for programmatic Security

web.xml:

Demo Program for programmatic Security

Example08
JCode Cell
1 
2<web-app>
3<servlet>
4<servlet-name>FirstSevlet</servlet-name>
5<servlet-class>FirstSevlet</servlet-class>
6<security-role-ref>
7<role-name>hero</role-name>
8<role-link>durgaadmin</role-link>
9</security-role-ref>
10</servlet>
11 
12<servlet-mapping>
13<servlet-name>FirstSevlet</servlet-name>
14<url-pattern>/test</url-pattern>
15</servlet-mapping>
16 
17<security-constraint>
18<web-resource-collection>
19<web-resource-name>CheckedServlet</web-resource-name>
20<url-pattern>/test</url-pattern>
21<http-method>GET</http-method>
22</web-resource-collection>
23<auth-constraint>
24<role-name>durgaadmin</role-name>
25<role-name>durgamanager</role-name>
26</auth-constraint>
27</security-constraint>
28 
29<login-config>
30<auth-method>BASIC</auth-method>
31</login-config>
32 
33<security-role>
34<role-name>durgaadmin</role-name>
35</security-role>
36 
37<security-role>
38<role-name>durgamanager</role-name>
39</security-role>
40</web-app>tomcat-users.xml:
41<tomcat-users>
42...
43<role rolename="durgaadmin"/>
44<role rolename="durgamanager"/>
45<user name="pawan" password="kalyan" roles="durgaadmin" />
46<user name="shiva" password="scwcd" roles="durgaadmin" />
47<user name="mahesh" password="babu" roles="durgamanager" />
48</tomcat-users>login.html:
49<html>
50<body><h1> Programatic Security To send Post Request</h1>
51<form action = "/webs3/test" method="POST">
52Enter Text :<input type=text name=uname>
53<input type=submit>
54</form>
55</body>
56</html>
57

FirstServlet.java

OCWCD

Question Bank

Example09
JCode Cell
1 
2import javax.servlet.*;
3import javax.servlet.http.*;
4import java.io.*;
5public class FirstSevlet extends HttpServlet
6{
7public void doGet(HttpServletRequest req,HttpServletResponse resp) throws ServletException,IOException
8{
9PrintWriter out = resp.getWriter();
10String name = req.getRemoteUser();
11out.println("<h1>Hi .."+name+"</h1><br>");
12if(req.isUserInRole("hero"))
13{
14out.println("<h1>This is Hero Home Page</h1>");
15}
16else
17{
18out.println("<h1>This is Others Home Page</h1>");
19}
20}
21public void doPost(HttpServletRequest req,HttpServletResponse resp) throws ServletException,IOException
22{
23doGet(req,resp);
24}
25}
26
📝 Key Takeaways
  • Key ideas of Servlet - Programmatic Security explained simply
  • Ready-to-use code examples
  • Exam-style questions at the end

🧠 Test Your Knowledge

3 Questions
Progress: 0 / 3