users@glassfish.java.net

Re: The menace of HTTP Status 404 in glassfish

From: Jeanfrancois Arcand <Jeanfrancois.Arcand_at_Sun.COM>
Date: Thu, 08 Jan 2009 10:07:10 -0500

Salut,

glassfish_at_javadesktop.org wrote:
> I am new to the glassfish and the hype surrounding it, particularly the v3. Try googling for info on glassfish v2.x, and v3 gets in the way--forget even v2.1 (I, however, digress).
>
> Here is what I have found:
>
> If you deploy EAR jar, and try to render a jsp or jsf page; if there is error associated with the page, glassfish displays a HTTP Status 404. These errors might include:
>
> 1. [Wrongly reported] Invalid ejb jar
> 2. Missing shared libraries
> 3. Classes declared in web.xml but missing in the source path or one that simply contains error
> 3. etc.

How do you deploy your application? The deployment must have failed,
hence your are getting 404, which is the expected status/error.


>
> In some cases, you might find the exact causes of the HTTP Status 404, if you look in your glassfish server.log but in most cases, NOTHING!

Do you have a test for that? I would be interested to play with it :-)


   For example after a succesfull verification and deployment, and you
then do:
>
> http://localhost:8080/foo-web/index.jsp
>
> And there is error somewhere or some missing shared libraries, the browser will display a HTTP Status 404 error page, but if you then look inside your server.log, you would only find:
>
> [#|2009-01-08T08:59:44.985+0000|SEVERE|sun-appserver9.1|org.apache.jasper.servlet.JspServlet|_ThreadID=27;_ThreadName=httpSSLWorkerThread-8080-0;_RequestID=1ff45167-4f60-4488-942b-bab781b97cf0;|PWC6117: File "/home/applications/glassfish/domains/domain1/docroot/foo-web/index.jsp" not found|#]

So far it seems OK to me :-)


>
> A few weeks ago, I posted this problem on this forum but with little response. I [still] occasional have this irritating problem. In glassfish, HTTP Status 404 error is meaningless, because it is used to catch all manners of errors--something you don't find in JBoss or Websphere.

Hum...Can you show me a test case that doesn't return a 404 on JBoss but
  404 on GlassFish? JBoss and GlassFish use the same Servlet to serve
static resources, and I would be surprised there is a difference in
behavior.


>
> It seem that when there is an error associated with a page, glassfish default to the glassfish/domains/domain1/docroot in search of the page and when it fails to find it there, it displays a HTTP Status 404.

Like Tomcat is doing :-)


This is WRONG: what developers want is the sources of the problem and
not a blank catch-it-all HTTP Status 404 page with no helpful info in
the server.log.

What is the proposed solution? We cannot expose internal information
over an error page and gives hint to attacked about missing resources,
application exceptions, etc. The less we share, the more secure we are.


>
> Atleast in development mode, there should be a way to switch off this default (to glassfish/domains/domain1/docroot) to get a print stack of the real problem causing the page not to render.

I'm really interested to see your test case as if the JSP fail for some
reason to compile/render, you should have got an exception from there
and not a 404.

Thanks for the feedback!

-- Jeanfrancois



> [Message sent by forum member 'nuffsaidx' (nuffsaidx)]
>
> http://forums.java.net/jive/thread.jspa?messageID=324721
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe_at_glassfish.dev.java.net
> For additional commands, e-mail: users-help_at_glassfish.dev.java.net
>