Spring MVC and Cookie

In a common scenario, a cookie may be set on the client side using JavaScript

function setCookie() {
    var c_name = "javascriptCookie";
    var c_value = "this cookie was set by JavaScript";
    document.cookie=c_name + "=" + c_value;
}

Spring MVC can also write cookie while returning a page

@RequestMapping(value="/setcookie", method = RequestMethod.GET)
public String setCookie(HttpServletResponse response){
    response.addCookie(new Cookie("srpingCookie", "this cookie was set by Spring"));
    return "cookieIsSet";
}

To read cookies on Spring

// all the cookies can be seen here regardless of that the cookie was set on client side or server side
@RequestMapping(value="/readcookie", method = RequestMethod.GET)
public String showCookie(HttpServletRequest request) {
    Cookie[] cookies = request.getCookies();
    if (cookies != null){
 for (Cookie cookie : cookies){
     System.out.println(cookie.getName() + " : " + cookie.getValue());
        }
    }
        
    ...
}

or

// mycookie must be available otherwise HTTP 400 occurs
// the cookie value will be unescape'd automatically
@RequestMapping(value="/readparticularcookie", method = RequestMethod.GET)
public String showDinoCookie(@CookieValue("mycookie") String cookie){
    System.out.println(cookie);

    ...
}

Reference
http://www.w3schools.com/js/js_cookies.asp

class vs primitive data type in Java

Java has 8 primitive data types, they are byte, short, int, long, float, double, boolean, and char, and also has class of each of them.

A class is a wrapper of a primitive variable, for example, the Integer class document states "The Integer class wraps a value of the primitive type int in an object. An object of type Integer contains a single field whose type is int."

But there is still difference in usage, the class type variable can be assigned with value null and stored in the container while a primitive variable cannot. But primitive type is found to have advantage in performance, here is the discussion, Why do people still use primitive types in Java?

Hibernate one-to-many with child entity using composite primary key

Scenario: A customer can have multiple orders. The customer entity has cid as primary key, the order has composite primary key (order_id + cid)

Database tables:

 CREATE TABLE customers (
    cid VARCHAR(8) PRIMARY KEY,
    name VARCHAR(255)
 );

 CREATE TABLE orders (
    order_id INT,
    customer_id VARCHAR(8),
    amount REAL,
    PRIMARY KEY(order_id, customer_id),
    FOREIGN KEY(customer_id) REFERENCES customers(cid)
 );

The Java code using Hibernate ORM will be

Customer.java

@Entity
@Table(name="customers")
public class Customer implements Serializable {
    @Id
    @Column(name="cid")
    private String customerId;

    @OneToMany(fetch=FetchType.EAGER, mappedBy="orderRecordPK.customer")
    @Cascade(CascadeType.ALL)
    private Set<OrderRecord> orderRecords = new HashSet<OrderRecord>();

    ...
    constructor, other fields, getters and setters
}    

OrderRecord.java

@Entity
@Table(name="orders")
public class Order implements Serializable {
    @EmbeddedId
    private OrderRecordPK orderRecordPK;

    ...
    constructor, other fields, getters and setters
}

OrderRecordPK.java

@Embeddable
public class OrderRecordPK implements Serializable{
    @Column(name="order_id")
    private int orderId;

    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name="customer_id", nullable=false)
    private Customer customer;

    ...
    constructor, other fields, getters and setters
}

Hibernate one-to-many with child entity using id as primary key

Scenario: A customer can have multiple phones. The customer entity has cid as primary key, and the phone has phone_id as primary key

Database tables:

 CREATE TABLE customers (
    cid VARCHAR(8) PRIMARY KEY,
    name VARCHAR(255)
 );

 CREATE TABLE phones (
    phone_id INT PRIMARY KEY,
    customer_id VARCHAR(8),
    number INT,
    FOREIGN KEY(customer_id) REFERENCES customers(cid)
 );

The Java code using Hibernate ORM will be

Customer.java

@Entity
@Table(name="customers")
public class Customer implements Serializable {
    @Id
    @Column(name="cid")
    private String customerId;

    @OneToMany(fetch=FetchType.EAGER, mappedBy="customer")
    @Cascade(CascadeType.ALL)
    private Set<OrderRecord> phones = new HashSet<OrderRecord>();

    ...
    constructor, other fields, getters and setters
}    

Phone.java

@Entity
@Table(name="phones")
public class Phone implements Serializable {
    @Id
    @Column(name="phone_id")
    private int phoneId;

    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name="customer_id", nullable=false)
    private Customer customer;

    ...
    constructor, other fields, getters and setters
}

Next, Hibernate one-to-many with child entity using composite primary key

Java class with generic type

Generic type T specifies the type of the object that will be handled in a class.
The advantage of using generic type is the object type is checked in compile time. A class that is designed to handle object with type A will not be mistakenly passed an object with Type B

Suppose we define a Container to store and retrieve an object. In order to know what type of object we will put later, we add type parameter T.

public interface Container<T> {
 public void set(T t);
 public T get();
}

and we have fruits Apple and Orange that will be put the in container

public class Apple {

 private String label;

 public Apple(String label) {
  super();
  this.label = label;
 }
 
 @Override
 public String toString() {
  return "Apple [label=" + label + "]";
 }

}

public class Orange {

 private String label;

 public Orange(String label) {
  super();
  this.label = label;
 }

 @Override
 public String toString() {
  return "Orange [label=" + label + "]";
 }

}

A box that implements Container will be used to put Apple or Orange

public class Box implements Container<T> {

 private T t;
 
 public void set(T t) {
  this.t = t;
 }
 public T get() {
  return t;
 }

}

To create a box that can have Apple only

Box<Apple> genericAppleBox = new Box<Apple>();

A box that can have Orange only

Box<Orange> genericOrangeBox = new Box<Orange>();

If we try to put an Orange in the apple box,

genericAppleBox.set(orange);

the compiler will complain, "The method set(Apple) in the type Box is not applicable for the arguments (Orange)"

The type parameter also can be specified in the class definition
To declare a box class that will store Apple only

public class AppleBox implements Container<Apple> {

 private Apple apple;

 public Apple get() {
  return apple;
 }

 public void set(Apple apple) {
  this.apple = apple;
 }
 
}

A box will will store Orange only

public class OrangeBox implements Container<Orange> {

 private Orange orange;

 public Orange get() {
  return orange;
 }

 public void set(Orange orange) {
  this.orange = orange;
 }

}

To create the box for Apple only

AppleBox specificAppleBox = new AppleBox();

To create the box for Orange only

OrangeBox specificOrangeBox = new OrangeBox();

If we try to put an Orange to the Apple box,

specificAppleBox.set(orange);

the compiler will complain, "The method set(Apple) in the type AppleBox is not applicable for the arguments (Orange)"

Reference
http://docs.oracle.com/javase/tutorial/java/generics/

Hibernate cascade error, Type mismatch: cannot convert from CascadeType to CascadeType[]

One day when I tried to use the Hibernate @Cascade annotation, the syntax was correct, but I had the error of "Type mismatch: cannot convert from CascadeType to CascadeType[]".

It turned out I had a mismatch import. To fix it, remove the line

        import javax.persistence.CascadeType;

then add the line

        import org.hibernate.annotations.CascadeType;

Reference
JPA & Hibernate annotation common mistake
http://www.mkyong.com/hibernate/cascade-jpa-hibernate-annotation-common-mistake/

Test Spring security protected web app using curl

Form-based authentication
1. Obtain a session and write it to the file. Note that the spring security path j_spring_security_check is used for this step
$ curl --data "j_username=myname&j_password=mypswd" http://localhost:8080/SpringSecurityAuth/j_spring_security_check --cookie-jar cookies.txt

2. Access the protected URL with the session
$ curl http://localhost:8080/SpringSecurityAuth/api/helloworld --cookie cookies.txt

HTTP basic authentication

Option 1

Send username and password for each request
$ curl --user myname:mypwsd http://localhost:8080/SpringSecurityAuth/api/helloworld

Option 2

1. Obrain a session similar to the way in form-based authentication, but using spring security path j_spring_security_check is not needed
$ curl --user byname:mypwsd http://localhost:8080/SpringSecurityAuth/api/helloworld --cookie-jar cookies.txt

2. Access the protected URL with the session
$ curl http://localhost:8080/SpringSecurityAuth/api/helloworld --cookie cookies.txt

Simple REST Stateless configuration
To achieve REST stateless feature, the element in security configuration file can be configured as follow

  <!-- Stateless RESTful service using Basic authentication -->
  <http pattern="/restful/**" create-session="stateless">
      <intercept-url pattern='/**' access='ROLE_REMOTE' />
      <http-basic />
  </http>

Then the saved session will not work and providing username and password is required for each request.

This feature can be achieved only with HTTP basic authentication because the form-based authentication needs to have a session to access the protected resource, but the session is not valid here.

This approach may not be secure enough because the username and password are transmitted in each request. To have a more secure implementation, using option to generate token and customer-filter to authenticate token may be required (authentication could be form-based or HTTP basic since token is being used).


Reference
Interact with a spring-security protected application
https://bowerstudios.com/node/913

Spring Security Basic Authentication
http://www.baeldung.com/spring-security-basic-authentication

Advanced Namespace Configuration
http://static.springsource.org/spring-security/site/docs/3.1.x/reference/security-filter-chain.html#filter-chains-with-ns