[Tomcat] STRICT_SERVLET_COMPLIANCE 내용

http://tomcat.apache.org/tomcat-6.0-doc/config/systemprops.html

Servlet 스펙을 Strict 하게 준수하게 위해서 STRICT_SERVLET_COMPLIANCE 옵션을 사용한다.

사실 Servlet 스펙 관련된 내용은STRICT_SERVLET_COMPLIANCE 말고도 ACTIVITY_CHECK, ALLOW_EQUALS_IN_VALUE, ALWAYS_ADD_EXPIRES 이렇게 3개가 더 있다.

Property

Description

org.apache.catalina. STRICT_SERVLET_COMPLIANCE

If this is true the following actions will occur: any wrapped request or response object passed to an application dispatcher will be checked to ensure that it has wrapped the original request or response. (SRV.8.2 / SRV.14.2.5.1) a call to Response.getWriter() if no character encoding has been specified will result in subsequent calls toResponse.getCharacterEncoding() returning ISO-8859-1and the Content-Type response header will include acharset=ISO-8859-1 component. (SRV.15.2.22.1) every request that is associated with a session will cause the session's last accessed time to be updated regardless of whether or not the request explicitly accesses the session. (SRV.7.6) cookies will be parsed strictly, by default v0 cookies will not work with any invalid characters.  If set to false, any v0 cookie with invalid character will be switched to a v1 cookie and the value will be quoted. ServletContext.getResource/getResourceAsStream must start with "/" if set to false, code like getResource("myfolder/myresource.txt") will work

SRV.8.2 Using a Request Dispatcher

To use a request dispatcher, a servlet calls either the include method or forward

method of the RequestDispatcher interface. The parameters to these methods can

be either the request and response arguments that were passed in via the service

method of the Servlet interface, or instances of subclasses of the request and

response wrapper classes that have been introduced for version 2.3 of the

specification. In the latter case, the wrapper instances must wrap the request or

response objects that the container passed into the service method.

The Container Provider must ensure that the dispatch of the request to a target

servlet occurs in the same thread of the same VM as the original request.

------------------------------------

SRV.14.2.5.1 Methods

forward(ServletRequest, ServletResponse)

public void forward(ServletRequest request,

ServletResponse response)

throws ServletException, IOException

include(ServletRequest, ServletResponse)

public void include(ServletRequest request,

ServletResponse response)

throws ServletException, IOException

----------------------------

두번째 내용은 스펙의 번호가 약간 잘못되지 않았나 싶다.

SRV.4.9 Request data encoding

Currently, many browsers do not send a char encoding qualifier with the Content-

Type header, leaving open the determination of the character encoding for reading

HTTP requests. The default encoding of a request the container uses to create the

request reader and parse POST data must be “ISO-8859-1” if none has been

specified by the client request. However, in order to indicate to the developer in this

case the failure of the client to send a character encoding, the container returns null

from the getCharacterEncoding method.

If the client hasn’t set character encoding and the request data is encoded with

a different encoding than the default as described above, breakage can occur. To

remedy this situation, a new method setCharacterEncoding(String enc) has

been added to the ServletRequest interface. Developers can override the

character encoding supplied by the container by calling this method. It must be

called prior to parsing any post data or reading any input from the request. Calling

this method once data has been read will not affect the encoding.

-> 이 내용은 브라우져 요청 데이터는  요청안에 content-type의 chatset이 빠져있으면, ISO-8859-1 로 디코딩이어야 한다는 것이다. IE가 한글 정보를 base64 인코딩하면서 '=' 문제가 커지는 부분이 발견되어서 톰캣 6.0.24부터 바뀐 얘기와 연관이 깊다.

--------------------------------------------

SRV.7.6 Last Accessed Times

The getLastAccessedTime method of the HttpSession interface allows a servlet to

determine the last time the session was accessed before the current request. The

session is considered to be accessed when a request that is part of the session is first

handled by the servlet container.

---------------------------------------------