public abstract Class WebUtils

Clear the Servlet spec's error attributes as jakarta.servlet.http.HttpServletRequest attributes under the keys defined in the Servlet 2.3 specification: jakarta.servlet.error.status_code, jakarta.servlet.error.exception_type, jakarta.servlet.error.message, jakarta.servlet.error.exception, jakarta.servlet.error.request_uri, jakarta.servlet.error.servlet_name.

Parameters

request:HttpServletRequest

current servlet request

Expose the Servlet spec's error attributes as jakarta.servlet.http.HttpServletRequest attributes under the keys defined in the Servlet 2.3 specification, for error pages that are rendered directly rather than through the Servlet container's error page resolution: jakarta.servlet.error.status_code, jakarta.servlet.error.exception_type, jakarta.servlet.error.message, jakarta.servlet.error.exception, jakarta.servlet.error.request_uri, jakarta.servlet.error.servlet_name.

Does not override values if already present, to respect attribute values that have been exposed explicitly before.

Exposes status code 200 by default. Set the "jakarta.servlet.error.status_code" attribute explicitly (before or after) in order to expose a different status code.

Parameters

request:HttpServletRequest

current servlet request

ex:Throwable

the exception encountered

servletName:String

the name of the offending servlet

Obtain a named parameter from the given request parameters.

See findParameterValue(java.util.Map, String) for a description of the lookup algorithm.

Parameters

request:ServletRequest

current HTTP request

name:String

the logical name of the request parameter

Returns:String

the value of the parameter, or null if the parameter does not exist in given request

Annotations

@Nullable

Obtain a named parameter from the given request parameters.

This method will try to obtain a parameter value using the following algorithm:

1. Try to get the parameter value using just the given logical name. This handles parameters of the form logicalName = value. For normal parameters, e.g. submitted using a hidden HTML form field, this will return the requested value.
2. Try to obtain the parameter value from the parameter name, where the parameter name in the request is of the form logicalName_value = xyz with "_" being the configured delimiter. This deals with parameter values submitted using an HTML form submit button.
3. If the value obtained in the previous step has a ".x" or ".y" suffix, remove that. This handles cases where the value was submitted using an HTML form image button. In this case the parameter in the request would actually be of the form logicalName_value.x = 123.

Parameters

parameters:Map<String, ?>

the available parameter map

name:String

the logical name of the request parameter

Returns:String

the value of the parameter, or null if the parameter does not exist in given request

Annotations

@Nullable

Retrieve the first cookie with the given name. Note that multiple cookies can have the same name but different paths or domains.

Parameters

request:HttpServletRequest

current servlet request

name:String

cookie name

Returns:Cookie

the first cookie with the given name, or null if none is found

Annotations

@Nullable

Return whether default HTML escaping is enabled for the web application, i.e. the value of the "defaultHtmlEscape" context-param in web.xml (if any).

This method differentiates between no param specified at all and an actual boolean value specified, allowing to have a context-specific default in case of no setting at the global level.

Parameters

servletContext:ServletContext

the servlet context of the web application

Returns:Boolean

whether default HTML escaping is enabled for the given application (null = no explicit default)

Annotations

@Nullable

Return an appropriate request object of the specified type, if available, unwrapping the given request as far as necessary.

Parameters

request:ServletRequest

the servlet request to introspect

requiredType:Class<T>

the desired type of request object

Returns:T

the matching request object, or null if none of that type is available

Annotations

@SuppressWarnings:unchecked

@Nullable

Return an appropriate response object of the specified type, if available, unwrapping the given response as far as necessary.

Parameters

response:ServletResponse

the servlet response to introspect

requiredType:Class<T>

the desired type of response object

Returns:T

the matching response object, or null if none of that type is available

Annotations

@SuppressWarnings:unchecked

@Nullable

Return a map containing all parameters with the given prefix. Maps single values to String and multiple values to String array.

For example, with a prefix of "spring_", "spring_param1" and "spring_param2" result in a Map with "param1" and "param2" as keys.

Parameters

request:ServletRequest

the HTTP request in which to look for parameters

prefix:String

the beginning of parameter names (if this is null or the empty string, all parameters will match)

Returns:Map<String, Object>

map containing request parameters without the prefix, containing either a String or a String array as values

See Also

jakarta.servlet.ServletRequest#getParameterNames, jakarta.servlet.ServletRequest#getParameterValues, jakarta.servlet.ServletRequest#getParameterMap

Return the real path of the given path within the web application, as provided by the servlet container.

Prepends a slash if the path does not already start with a slash, and throws a FileNotFoundException if the path cannot be resolved to a resource (in contrast to ServletContext's getRealPath, which returns null).

Parameters

servletContext:ServletContext

the servlet context of the web application

path:String

the path within the web application

Returns:String

the corresponding real path

Exceptions

FileNotFoundException:

if the path cannot be resolved to a resource

See Also

jakarta.servlet.ServletContext#getRealPath

Check the given request for a session attribute of the given name. Throws an exception if there is no session or if the session has no such attribute. Does not create a new session if none has existed before!

Parameters

request:HttpServletRequest

current HTTP request

name:String

the name of the session attribute

Returns:Object

the value of the session attribute, or null if not found

Exceptions

IllegalStateException:

if the session attribute could not be found

Return whether response encoding should be used when HTML escaping characters, thus only escaping XML markup significant characters with UTF-* encodings. This option is enabled for the web application with a ServletContext param, i.e. the value of the "responseEncodedHtmlEscape" context-param in web.xml (if any).

This method differentiates between no param specified at all and an actual boolean value specified, allowing to have a context-specific default in case of no setting at the global level.

Parameters

servletContext:ServletContext

the servlet context of the web application

Returns:Boolean

whether response encoding is to be used for HTML escaping (null = no explicit default)

Annotations

@Nullable

Since

4.1.2

Check the given request for a session attribute of the given name. Returns null if there is no session or if the session has no such attribute. Does not create a new session if none has existed before!

Parameters

request:HttpServletRequest

current HTTP request

name:String

the name of the session attribute

Returns:Object

the value of the session attribute, or null if not found

Annotations

@Nullable

Determine the session id of the given request, if any.

Parameters

request:HttpServletRequest

current HTTP request

Returns:String

the session id, or null if none

Annotations

@Nullable

Return the best available mutex for the given session: that is, an object to synchronize on for the given session.

Returns the session mutex attribute if available; usually, this means that the HttpSessionMutexListener needs to be defined in web.xml. Falls back to the HttpSession itself if no mutex attribute found.

The session mutex is guaranteed to be the same object during the entire lifetime of the session, available under the key defined by the SESSION_MUTEX_ATTRIBUTE constant. It serves as a safe reference to synchronize on for locking on the current session.

In many cases, the HttpSession reference itself is a safe mutex as well, since it will always be the same object reference for the same active logical session. However, this is not guaranteed across different servlet containers; the only 100% safe way is a session mutex.

Parameters

session:HttpSession

the HttpSession to find a mutex for

Returns:Object

the mutex object (never null)

See Also

SESSION_MUTEX_ATTRIBUTE, HttpSessionMutexListener

Return the temporary directory for the current web application, as provided by the servlet container.

Parameters

servletContext:ServletContext

the servlet context of the web application

Returns:File

the File representing the temporary directory

Check if a specific input type="submit" parameter was sent in the request, either via a button (directly with name) or via an image (name + ".x" or name + ".y").

Parameters

request:ServletRequest

current HTTP request

name:String

the name of the parameter

Returns:boolean

if the parameter was sent

See Also

SUBMIT_IMAGE_SUFFIXES

Determine whether the given request is an include request, that is, not a top-level HTTP request coming in from the outside.

Checks the presence of the "jakarta.servlet.include.request_uri" request attribute. Could check any request attribute that is only present in an include request.

Parameters

request:ServletRequest

current servlet request

Returns:boolean

whether the given request is an include request

Check if the request is a same-origin one, based on Origin, Host, Forwarded, X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port headers.

Returns:boolean

true if the request is a same-origin one, false in case of cross-origin request

Since

4.2

Check the given request origin against a list of allowed origins. A list containing "*" means that all origins are allowed. An empty list means only same origin is allowed.

Returns:boolean

true if the request origin is valid, false otherwise

Since

4.1.5

See Also

RFC 6454: The Web Origin Concept

Parse the given string with matrix variables. An example string would look like this "q1=a;q1=b;q2=a,b,c". The resulting map would contain keys "q1" and "q2" with values ["a","b"] and ["a","b","c"] respectively.

Parameters

matrixVariables:String

the unparsed matrix variables string

Returns:MultiValueMap<String, String>

a map with matrix variable names and values (never null)

Since

3.2

Remove the system property that points to the web app root directory. To be called on shutdown of the web application.

Parameters

servletContext:ServletContext

the servlet context of the web application

See Also

setWebAppRootSystemProperty

Set the session attribute with the given name to the given value. Removes the session attribute if value is null, if a session existed at all. Does not create a new session if not necessary!

Parameters

request:HttpServletRequest

current HTTP request

name:String

the name of the session attribute

value:Object

the value of the session attribute

Set a system property to the web application root directory. The key of the system property can be defined with the "webAppRootKey" context-param in web.xml. Default is "webapp.root".

Can be used for tools that support substitution with System.getProperty values, like log4j's "${key}" syntax within log file locations.

Parameters

servletContext:ServletContext

the servlet context of the web application

Exceptions

IllegalStateException:

if the system property is already set, or if the WAR file is not expanded

See Also

WEB_APP_ROOT_KEY_PARAM, DEFAULT_WEB_APP_ROOT_KEY, WebAppRootListener