jsr340-experts@servlet-spec.java.net

[jsr340-experts] Re: [servlet-spec users] Re: Re: Configuring DENY semantic for uncovered HTTP Methods

From: Greg Wilkins <gregw_at_intalio.com>
Date: Fri, 8 Feb 2013 17:44:09 +1100

On 8 February 2013 09:50, Bill Shannon <bill.shannon_at_oracle.com> wrote:
> Sometimes reasonable people just disagree. A decision still needs to be
> made. That's the job of the Spec Lead.

Sure, and I'm not seeing a ground swell of support for my proposal
(yet), so unless it comes soon will accept the spec leads call.

On 8 February 2013 09:51, Bill Shannon <bill.shannon_at_oracle.com> wrote:
> Logging is not a solution.

Actually I think that logging is an essential part of any solution.

Both proposals are only applicable to developers/deployers who know
that there is an issue with uncovered methods and want to avoid them.
  Developers who are unaware of the issue wont turn on the mode no
matter what the new mode is.

Adding logging to tell developers about uncovered methods is a real
solution to educate the developers. Once they know there is an
issue, they already have the expressive power in web.xml to fix the
problem as they can already just work out the constraints needed (or
the warning can do that for them) and add them to web.xml.
Essentially the current proposal is to make it just a bit easier to
fix the problem once you are aware of it by adding a single element
rather than working out the constraints needed to avoid uncovered
methods.

Note that my proposal is no more of a solution either, as it too will
only be used by developers who are aware of the issue. I just think
it is a better "easy way" for them to avoid uncovered methods. If you
agree with me, now is the time to speak up else we'll just be putting
another band aid on this thing!

regards

-- 
Greg Wilkins <gregw_at_intalio.com>
http://www.webtide.com
Developer advice and support from the Jetty & CometD experts.
Intalio, the modern way to build business applications.