Path: csiph.com!aioe.org!.POSTED!not-for-mail From: =?UTF-8?Q?Arne_Vajh=c3=b8j?= Newsgroups: comp.lang.java.programmer Subject: Re: Web services/SOA - The right way Date: Mon, 22 Aug 2016 12:05:21 -0400 Organization: Aioe.org NNTP Server Lines: 30 Message-ID: References: NNTP-Posting-Host: 7SK6yTFfqwlIPNBLl3l7Qg.user.gioia.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: abuse@aioe.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 X-Notice: Filtered by postfilter v. 0.8.2 Xref: csiph.com comp.lang.java.programmer:35426 On 8/22/2016 3:01 AM, Alberto Salvati wrote: > Now, I've a (BETA!) webapp developed using netbeans that: > > 1) runs on Tomcat 8 2) exposes 3 different servelets with doGet > override methods 3) uses a MySql database > > Also, I've a delphi xe7 application that uses this webapp via HTTP > protocol. It sounds like a poor webapp, but I'm a newbie and on > september I'll have a demo with a my customer. So, I need something > to show. > > Next, I'll work about secure my webapp (no basic HTTP > authentication). A few random notes: - plain servlets is a bit primitive but as long as the in and out data are simple then it will work great - with more complex data then you need something that handles the low level stuff for you - either JAX-WS or JAX-RS - and if you need to support mobile then go for JAX-RS - when enabling authentication you should switch from HTTP to HTTPS - regarding authentication then you could use container managed authentication and set it to BASIC (nor FORM), but I would suggest that you instead use a service specific HTTP header and implemented the check in an abstract service base class or in a servlet filter Arne