We Keep Coding

What is the reason that the tomcat is not an application server

I know that Tomcat is a web server but why it is not an application server?
Any server needs to follow some specification. What is that spec?
Is it possible for apache to make the tomcat application server?
Also I have read in a blog that the tomcat do not have some lib to act as an application server. What are those libs?
Thanks

I've heard once the following explanation I tend to agree with:
There is a spec of JEE (Java enterprise edition).
Formally you can think about it as a bunch of pdf-s describing the behavior of various technologies that comprise the JEE stack (for example: JMS, EJB, JPA, JPA, JSF, CDI and so on and so forth) as well as deployment models (EARs for example).
Implementors of Application servers have to implement all those technologies and offer interfaces that can be used by the application developers. So teams that stand behind WildFly (former JBoss), Geronimo, WebSphere, WebLogic and so on have read these specs and implemented everything in there.
Now, Tomcat didn't do that, they've only concentrated on (primarily) Servlets/JSPs. These are web technologies, so Tomcat can't be considered as an Application server that implements the whole JEE stack.
In general Tomcat (as well as Jetty, incidentally) should be more lightweight than full JEE compliant Application servers, it should start-up faster and it memory footprint should be smaller. So Tomcat/Jetty call themselves web servers.
I understand that this answer can be considered as speculation, but for me it makes a lot of sense.

Bellow is my perceive:
know that Tomcat is a web server but why it is not an application server?
Here, Application Server is specially for Java EE Server，Java EE is a huge specific collections for Enterprice Application Development，So Application Server should implement most specifics of these, while Tomcat(or Jetty) is only a Web Server(More accurately，Servlet Container)，they only implements the specific about Web(such as Servlet Spec(JSR340), JSP(JSR245)). Therefore，Application Server is stronger than Web Server，but Web Server is more lightweight and enough to satisfy most web applications.
Any server needs to follow some specification. What is that spec?
Of course，it depends on that your Server want to provide what services(functions)，these specifications can view here.
Is it possible for apache to make the tomcat application server?
I don't think apache will make tomcat to be an application server. Now, there are some popular Java EE Server: Jboss，WebLogic, etc. Not all enterprices need a heavyweight Application Server, on the contrary, most only need a lightweight Web Server。
Also I have read in a blog that the tomcat do not have some lib to act as an application server. What are those libs?
Tomcat only need care the specs about Web，and implements them.
Hope for your help.

What is the difference between Tomcat, JBoss and Glassfish?

I am starting to look into Enterprise Java and the book I am following mentions that it will use JBoss. Netbeans ships with Glassfish. I have used Tomcat in the past.
What are the differences between these three programs?

Tomcat is just a servlet container, i.e. it implements only the servlets and JSP specification. Glassfish and JBoss are full Java EE servers (including stuff like EJB, JMS, ...), with Glassfish being the reference implementation of the latest Java EE 6 stack, but JBoss in 2010 was not fully supporting it yet.

Tomcat is merely an HTTP server and Java servlet container. JBoss and GlassFish are full-blown Java EE application servers, including an EJB container and all the other features of that stack. On the other hand, Tomcat has a lighter memory footprint (~60-70 MB), while those Java EE servers weigh in at hundreds of megs. Tomcat is very popular for simple web applications, or applications using frameworks such as Spring that do not require a full Java EE server. Administration of a Tomcat server is arguably easier, as there are fewer moving parts.
However, for applications that do require a full Java EE stack (or at least more pieces that could easily be bolted-on to Tomcat)... JBoss and GlassFish are two of the most popular open source offerings (the third one is Apache Geronimo, upon which the free version of IBM WebSphere is built). JBoss has a larger and deeper user community, and a more mature codebase. However, JBoss lags significantly behind GlassFish in implementing the current Java EE specs. Also, for those who prefer a GUI-based admin system... GlassFish's admin console is extremely slick, whereas most administration in JBoss is done with a command-line and text editor. GlassFish comes straight from Sun/Oracle, with all the advantages that can offer. JBoss is NOT under the control of Sun/Oracle, with all the advantages THAT can offer.

You should use GlassFish for Java EE enterprise applications.
Some things to consider:
A web Server means: Handling HTTP requests (usually from
browsers).
A Servlet Container (e.g. Tomcat) means: It can handle
servlets & JSP.
An Application Server (e.g. GlassFish) means: *It can manage
Java EE applications (usually both servlet/JSP and EJBs).
Tomcat - is run by Apache community - Open source and has two flavors:
Tomcat - Web profile - lightweight which is only servlet container and does not support Java EE features like EJB, JMS etc.
Tomcat EE - This is a certified Java EE container, this supports all Java EE technologies.
No commercial support available (only community support)
JBoss - Run by RedHat
This is a full-stack support for JavaEE and it is a certified Java EE container.
This includes Tomcat as web container internally.
This also has two flavors:
Community version called Application Server (AS) - this will have only community support.
Enterprise Application Server (EAP) - For this, you can have a subscription-based license (It's based on the number of Cores you have on your servers.)
Glassfish - Run by Oracle
This is also a full stack certified Java EE Container. This has its own web container (not Tomcat).
This comes from Oracle itself, so all new specs will be tested and implemented with Glassfish first. So, always it would support the latest spec. I am not aware of its support models.

jboss and glassfish include a servlet container(like tomcat), however the two application servers (jboss and glassfish) also provide a bean container (and a few other things aswell I imagine)

It seems a bit discouraging to use Tomcat when you read these answers. However what most fail to mention is that you can get to identical or almost identical use cases with tomcat but that requires you to add the libraries needed (through Maven or whatever include system you use).
I have been running tomcat with JPA, EJBs with very small configuration efforts.

JBoss and Glassfish are basically full Java EE Application Server whereas Tomcat is only a Servlet container.
The main difference between JBoss, Glassfish but also WebSphere, WebLogic and so on respect to Tomcat but also Jetty, was in the functionality that an full app server offer. When you had a full stack Java EE app server you can benefit of all the implementation of the vendor of your choice, and you can benefit of EJB, JTA, CDI(JAVA EE 6+), JPA, JSF, JSP/Servlet of course and so on. With Tomcat on the other hands you can benefit only of JSP/Servlet. However to day with advanced Framework such as Spring and Guice, many of the main advantage of using an a full stack application server can be mitigate, and with the assumption of a one of this framework manly with Spring Ecosystem, you can benefit of many sub project that in the my work experience let me to left the use of a full stack app server in favour of lightweight app server like tomcat.

Both JBoss and Tomcat are Java servlet application servers, but JBoss is a whole lot more. The substantial difference between the two is that JBoss provides a full Java Enterprise Edition (Java EE) stack, including Enterprise JavaBeans and many other technologies that are useful for developers working on enterprise Java applications.
Tomcat is much more limited. One way to think of it is that JBoss is a Java EE stack that includes a servlet container and web server, whereas Tomcat, for the most part, is a servlet container and web server.

Apache tomcat is just an only serverlet container it does not support for Enterprise Java application(JEE). JBoss and Glassfish are supporting for JEE application but Glassfish much heavy than JBOSS server : Reference Slide

Difference between tomcat and resin?

I like to know what are the differences between Tomcat container and Resin container

Tomcat is a stand alone web server supporting the J2EE web technologies (eg. Servlets, JSP) and Resin is a full blown J2EE Application server which includes a web server plus the rest of the J2EE family of technologies (eg. EJB). Tomcat is always free to use for any purpose. Resin is free only for open source or hobby use. Commercial use of Resin is not free. One interesting feature of Resin is the ability to run PHP applications under the JVM through Quercus.

Have a look here and here
Resin's high-performance application server features load balancing for increased reliability. Resin encourages separation of content from style with its fast XML and XSL support.Resin is available in two versions, Professional and Open Source. Professional has features commonly needed in a production environment while the Open Source version is said to be suitable for hobbyists and low traffic websites.
Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies.

Resin server is performance side very high and cost also high whether compare than tomcat server.

Security of Tomcat versus WebSphere versus WebLogic

The company I work for sells a J2EE application that runs on Tomcat, WebSphere, or WebLogic. We have a customer that is trying to decide between Tomcat and WebSphere. They're leaning towards WebSphere because they're concerned that Tomcat has more security holes.
After searching around on the web, I've been unable to find any sites or studies that compare the robustness of the major J2EE application servers from a security standpoint.
Can any of you point me to information comparing app server security holes?

It's interesting that your client is "concerned that Tomcat has more security holes." I wonder if they could list what those holes are? If they can't, it's hearsay and FUD.
I would say that all web servers/servlet engines suffer from the same issues. It's the applications that are deployed on them that represent the real security holes. Cross-site scripting, SQL injection, lack of input validation, exposure of sensitive data due to poor layering and practices - these are all application issues that will be problems regardless of which app server you choose.
My personal opinion is that WebLogic is the best Java EE app server on the market. I don't have first-hand experience with WebSphere, but people that I respect who have tell me that it's a horror show. I've only used Tomcat for local development. It's never failed me, but that's hardly production experience. I have no idea how it scales.
I'd think carefully about Spring's dm Server, based on Tomcat, Spring, and OSGi. I have a feeling that it represents a future direction that all its competitors will be taking.

I'd say use tomcat over WebSphere if at all possible.
I think 99% of security is how you set it all up.
Are you also evaluating the security implications of Apache HTTP Server, IBM HTTP Server, and IIS?
Security involves so much more than just what application server you choose to run your webapp on.
Tomcat security report
Websphere security report (You have to dig into each update to see what was fixed)

In my experience, WebSphere isn't adding anything that isn't spec (and thus somewhat supported on Tomcat). The problem comes when trying to do some more complex security tricks (admin authentication using SecureID or something) you need to dig much deeper. WebSphere tries to put more of that in the UI Console.
That being said, your company should look at testing on Glassfish. It uses Tomcat as it's servlet container, but adds a much better UI for management.

According to this article, WebSphere community addition is no different than Tomcat 5.5 in terms of the servlet engine. In my opinion, this decision should be based on overall features needed rather than perceived "security holes".

Several different surveys have confirmed that Tomcat is running at over 60% of organizations worldwide, including the largest banks. As others have said, Tomcat security is not the issue. What "Plain Vanilla" Tomcat lacks is the console and UI which many enterprises require for access controls, diagnostics, monitoring, alerts and provisioning. Check out Tcat server from MuleSoft. It's 100% Tomcat (no fork), but has the enterprise capabilities for running Tomcat.

I can't say whether one is better than the other as I have never used Tomcat, and you really haven't defined what your security requirements are. Security can be a rather large beast and involve varying levels. So you will need well defined requirements to even determine what Security features are required.
We use Websphere integrated with several other IBM products to provide secure access to our application, which has been working well for us so far. You can look up Webseal and the Tivoli line of products for added security to WebSphere.

What web server should I use with NetBeans?

I haven't been around Java development for 8 years, but am starting to build a NetBeans Web Application. When I walk through the Web Application wizard, it asks for the server I'm going to be using.
What would be the best and simplest server for me to start using with NetBeans?

Since the NetBeans IDE is a Sun product, I would assume that the Glassfish application server would be a natural fit.
That said, one of the pluses of developing a web application in Java is that the interface for working with the http is standardized (i.e. the Servlet specification), so that you can pick any servlet container you want: be it Glassfish, Tomcat, Jetty or Weblogic. Since it sounds to me that you're experimenting and you want to use something easy to administer, I might go with Glassfish. However, be open to revisit that decision when you need to actually deploy your web application in a production environment. Be sure to check out other options like Tomcat or Jetty.

Unless you are deploying to a full J2EE application server, I would recommend using Tomcat. Tomcat can run as a standalone web/servlet/jsp server and avoids some of the complexities of a full J2EE app server.
The web development bundle for Netbeans will include installers for and automated integration with Glassfish and Tomcat. You will get the "best" experience using Netbeans with those servers.
That said, the workflow in Netbeans can be easily integrated with other application servers. As of 6.1, this includes Sun Java System Application Server 8 and 9, GlassFish v1 and v2, Apache Tomcat 4, 5 and 6, JBoss 4, BEA WebLogic 10, IBM WebSphere 6.0 and 6.1, Sailfin V1. See the Netbeans J2EE Features site for more info.

Glassfish is actually an easy to use app server. I think it's easier for a beginner to use and it's integrated with Netbeans. Setting up database connection caches is easy, for example.
You administer the server through this web page:
http://localhost:4848
(login: admin, password: adminadmin)
Glassfish will run your apps on port 8080.
The Glassfish home page: http://glassfish.dev.java.net (don't really need to read)
For non-Netbeans users there's a QuickStart guide:
http://glassfish.dev.java.net/downloads/quickstart/index.html
Here's a screencast overview:
http://download.java.net/javaee5/screencasts/admin-console/index.html
At some point you will want to learn Tomcat too because it's so prevalent, but Glassfish is a much friendlier start. In fact, it's probably better as a production server too, if you can find an affordable host.