We Keep Coding

Spring 5 upgrade issue ResourceServlet

I'm moving from spring 4 to spring 5 (no spring boot yet) and after finally resolving dependency hell (at least I think so) I have problem with deploying app to tomcat with such stacktrace
Caused by: java.lang.ClassNotFoundException: org.springframework.web.servlet.ResourceServlet
at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1305)
at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1157)
... 18 more
I know that ResourceServlet is replaced with ResourceHttpRequestHandler but I cannot find place where I use in some way this ResourceServlet. Any idea how can I get rid of this is welcome.
Here is my web.xml for starters:
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
version="3.1">
<distributable />
<display-name>app</display-name>
<context-param>
<param-name>log4jExposeWebAppRoot</param-name>
<param-value>false</param-value>
</context-param>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>WEB-INF/application-context.xml WEB-INF/application-security.xml</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- javamelody - web app monitoring tool -->
<filter>
<filter-name>javamelody</filter-name>
<filter-class>net.bull.javamelody.MonitoringFilter</filter-class>
<async-supported>true</async-supported>
</filter>
<filter-mapping>
<filter-name>javamelody</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>ASYNC</dispatcher>
</filter-mapping>
<listener>
<listener-class>net.bull.javamelody.SessionListener</listener-class>
</listener>
<servlet>
<servlet-name>dispatcherservlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>WEB-INF/application-context.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>dispatcherservlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>cxf</servlet-name>
<servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
<load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>cxf</servlet-name>
<url-pattern>/services/*</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>jolokia-agent</servlet-name>
<servlet-class>org.jolokia.http.AgentServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>jolokia-agent</servlet-name>
<url-pattern>/jolokia/*</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>TrackerServlet</servlet-name>
<servlet-class>log4jwebtracker.servlet.TrackerServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>TrackerServlet</servlet-name>
<url-pattern>/tracker/*</url-pattern>
</servlet-mapping>

How do I prevent directory listing in Jetty?

Basically I have this jetty server running at my local. But I can't access my index.jsp file I see like that
this is my web.xml file, You see I use Apache CXF, and also use Spring, Hibernate and Jetty
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
version="3.1">
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:applicationContext.xml,classpath:Spring-Security.xml</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- Spring Security Start -->
<listener>
<listener-class>
org.springframework.web.context.request.RequestContextListener
</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy
</filter-class>
</filter>
<!-- Projenin ana url'inden itibaren spring security aktif ediliyor -->
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- Spring Security End -->
<servlet>
<servlet-name>CXFServlet</servlet-name>
<servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>CXFServlet</servlet-name>
<url-pattern>/*</url-pattern>
</servlet-mapping>
</web-app>
How can I resolve it. Where I am doing wrong ?

This has been answered in a few places on StackOverflow. You simply need to set the dirAllowed parameter to false on the default servlet. This can be done either in the WEB-INF/web.xml of the servlet descriptor or by providing a modified etc/webdefault.xml file (via the deploy module in Jetty, for example) which is loaded before any of the contexts.
In either file this would look like:
<servlet>
<servlet-name>default</servlet-name>
<servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>
....
<init-param>
<param-name>dirAllowed</param-name>
<param-value>false</param-value>
</init-param>
....
</servlet>
As user Eng.Fouad points out this can also be defined as a context parameter:
<context-param>
<param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
<param-value>false</param-value>
</context-param>

Migrating to Jersey 2.x getting 404 errors while calling my api's

I am migrating from com.sun.jersey 1.x to org.glassfish.jersey 2.x,
my web.xml looks like:
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<!-- Bean Configuration -->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:application-context.xml</param-value>
</context-param>
<context-param>
<param-name>webAppRootKey</param-name>
<param-value>webservices</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
<listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>
<servlet>
<servlet-name>jersey-servlet</servlet-name>
<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
<init-param>
<param-name>jersey.config.server.provider.packages</param-name>
<param-value>com.jersey.series.spring.security.service</param-value>
</init-param>
<init-param>
<param-name>jersey.config.server.provider.packages</param-name>
<param-value>com.xyz.webservices</param-value>
</init-param>
<!-- Enable / Disable Jersey Tracing and Logging. -->
<init-param>
<param-name>jersey.config.server.tracing</param-name>
<param-value>${jersey.enable.trace}</param-value>
</init-param>
<init-param>
<param-name>jersey.disable.wadl</param-name>
<param-value>${jersey.disable.wadl}</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>jersey-servlet</servlet-name>
<url-pattern>/api/*</url-pattern>
</servlet-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<welcome-file-list>
<welcome-file>index.html</welcome-file>
<welcome-file>index.htm</welcome-file>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
So the resources defined under com.xyz.webservices.resources, whenever are called like '/app/api/data' says 404 page not found. Am i doing something wrong here?

I got the code working by modifying my web.xml as:
<init-param>
<param-name>jersey.config.server.provider.packages</param-name>
<param-value>com.jersey.series.spring.security.service,com.xyz.webservices</param-value>
</init-param>
<!-- Enable / Disable Jersey Tracing -->
<init-param>
<param-name>jersey.config.server.tracing</param-name>
<param-value>${jersey.enable.trace}</param-value>
</init-param>
<init-param>
<param-name>jersey.disable.wadl</param-name>
<param-value>${jersey.disable.wadl}</param-value>
</init-param>
<!-- Enabling Jackson Feature and Logging -->
<init-param>
<param-name>jersey.config.server.provider.classnames</param-name>
<param-value>org.glassfish.jersey.jackson.JacksonFeature,org.glassfish.jersey.filter.LoggingFilter,org.glassfish.jersey.server.filter.EncodingFilter,org.glassfish.jersey.message.DeflateEncoder,org.glassfish.jersey.message.GZipEncoder</param-value>
</init-param>

correct way to provide Spring configuration files in web.xml

In my sample SPring project I'm using the following web.xml,
I think that it fails to properly use
root-context.xml
servlet-context.xml
security-context.xml
How should I change it in order to provide these three configuration files
correctly ?
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5">
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/appServlet/app-security-context.xml
</param-value>
</context-param>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<servlet>
<servlet-name>appServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/appServlet/servlet-context.xml
</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>appServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
</web-app>

Typical the filter-mapping is located after the servlet mapping (Adjusting web.xml listeners, filters and servlets)
One other thing looks strange: you wrote that you have a:
root-context.xml
servlet-context.xml
security-context.xml
Of course the name "root-context.xml" is not standardized, but I expect that his is the spring configuration file that contains the services, DAO, db connection but not the web-controller stuff. If it is so, then you should load your root-context.xml with the "inner-application context" created by ContextLoaderListener and configured by context-param contextConfigLocation. The security-context.xml MUST also been loaded by the ContextLoaderListener, so if there is no import for security-context.xml in root-context.xml then you must configure them both in contextConfigLocation
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/appServlet/root-context.xml,
/WEB-INF/spring/appServlet/app-security-context.xml
</param-value>
</context-param>
Maybe you should have a look at this question: ContextLoaderListener or not? - the question an the accepted answer explain a bit of how the two contexts work.

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="3.0"
xmlns="http://java.sun.com/xml/ns/javaee"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
<display-name>Archetype Created Web Application</display-name>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:spring-security.xml,
classpath:spring-mybatis.xml
</param-value>
</context-param>
<servlet>
<servlet-name>SpringMVC</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring-mvc.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>SpringMVC</servlet-name>
<!-- 此处可以可以配置成*.do，对应struts的后缀习惯 -->
<url-pattern>*.do</url-pattern>
</servlet-mapping>
<!-- 编码过滤器 -->
<filter>
<filter-name>encodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
</filter>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>encodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- Spring监听器 -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- 防止Spring内存溢出监听器 -->
<listener>
<listener-class>org.springframework.web.util.IntrospectorCleanupListener</listener-class>
</listener>
<welcome-file-list>
<welcome-file>/index.jsp</welcome-file>
</welcome-file-list>
</web-app>

Spring Security needs ContextLoaderListener but I'm using annotated configuration, what to do?

I was using annotated configuration for my Spring web app and then had to mix XML with it so that I could use Spring Security. I annotated one of my configuration classes with #ImportResource("security-config.xml") to load the security config. The configuration beans are being created just fine. My web.xml looks like so:
<?xml version="1.0" encoding="UTF-8"?>
<web-app id="com-timbuk2-webapp-compositor"
version="3.0"
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" >
<!-- Spring Security Chain -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- Character Encoding -->
<filter>
<filter-name>characterEncodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>characterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- URL Rewrite -->
<filter>
<filter-name>urlRewriteFilter</filter-name>
<filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
<init-param>
<param-name>logLevel</param-name>
<param-value>commons</param-value>
</init-param>
<init-param>
<param-name>confPath</param-name>
<param-value>/WEB-INF/conf/urlrewrite-config.xml</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>urlRewriteFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- Listeners -->
<listener>
<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
</listener>
<!-- Context Parameters -->
<context-param>
<param-name>log4jConfigLocation</param-name>
<param-value>/WEB-INF/conf/log4j-config.xml</param-value>
</context-param>
<!-- Servlets -->
<servlet>
<servlet-name>app-dispatcher</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextClass</param-name>
<param-value>org.springframework.web.context.support.AnnotationConfigWebApplicationContext</param-value>
</init-param>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>com.website.config</param-value>
</init-param>
<load-on-startup>0</load-on-startup>
</servlet>
<!-- Servlet mappings -->
<servlet-mapping>
<servlet-name>app-dispatcher</servlet-name>
<url-pattern>/app/*</url-pattern>
</servlet-mapping>
</web-app>
From what I understand the springSecurityFilterChain needs ContextLoaderListener. However, because of how my app is configured, if I add:
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
to my web.xml my app doesn't initialize. Is there a way to manually create a ContextLoaderListener in my annotated configuration?

Just create a root application context by using the ContextLoaderListener.
<context-param>
<description>The Spring configuration files.</description>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/application.xml</param-value>
</context-param>
<listener>
<description>The Spring context listener.</description>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
Inside the application.xml, you also can define the annotation based config. It will be inherited by the WebApplicationContext of your DispatcherServlet definition.
Then you import your security configuration inside the application.xml. So security will apply to all ApplicationContexts in your configuration.

I believe it works with the following additions under web-app
<context-param>
<param-name>contextClass</param-name>
<param-value>
org.springframework.config.java.context.JavaConfigWebApplicationContext
</param-value>
</context-param>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>com.website.config</param-value>
</context-param>
source : http://blog.springsource.com/2008/03/26/spring-java-configuration-whats-new-in-m3/

Do not forget to add "classpath:/" if your root.xml is somewhere different from the web.xml dir. Hope this will help someone in the future.
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:/appcontext-root.xml</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>