org.springframework.remoting.httpinvoker

Class SimpleHttpInvokerServiceExporter

java.lang.Object

org.springframework.remoting.support.RemotingSupport

org.springframework.remoting.support.RemoteExporter

org.springframework.remoting.support.RemoteInvocationBasedExporter

org.springframework.remoting.rmi.RemoteInvocationSerializingExporter

org.springframework.remoting.httpinvoker.SimpleHttpInvokerServiceExporter

All Implemented Interfaces:

com.sun.net.httpserver.HttpHandler, Aware, BeanClassLoaderAware, InitializingBean

@UsesSunHttpServer
public class SimpleHttpInvokerServiceExporter
extends RemoteInvocationSerializingExporter
implements com.sun.net.httpserver.HttpHandler

HTTP request handler that exports the specified service bean as HTTP invoker service endpoint, accessible via an HTTP invoker proxy. Designed for Sun's JRE 1.6 HTTP server, implementing the HttpHandler interface.

Deserializes remote invocation objects and serializes remote invocation result objects. Uses Java serialization just like RMI, but provides the same ease of setup as Caucho's HTTP-based Hessian and Burlap protocols.

HTTP invoker is the recommended protocol for Java-to-Java remoting. It is more powerful and more extensible than Hessian and Burlap, at the expense of being tied to Java. Nevertheless, it is as easy to set up as Hessian and Burlap, which is its main advantage compared to RMI.

WARNING: Be aware of vulnerabilities due to unsafe Java deserialization: Manipulated input streams could lead to unwanted code execution on the server during the deserialization step. As a consequence, do not expose HTTP invoker endpoints to untrusted clients but rather just between your own services. In general, we strongly recommend any other message format (e.g. JSON) instead.

Since:

2.5.1

Author:

Juergen Hoeller

See Also:

HttpInvokerClientInterceptor, HttpInvokerProxyFactoryBean, SimpleHessianServiceExporter, SimpleBurlapServiceExporter

Field Summary

Fields inherited from class org.springframework.remoting.rmi.RemoteInvocationSerializingExporter

CONTENT_TYPE_SERIALIZED_OBJECT

Fields inherited from class org.springframework.remoting.support.RemotingSupport

logger

Constructor Summary

Constructors

Constructor and Description
SimpleHttpInvokerServiceExporter()

Method Summary

Modifier and Type	Method and Description
protected InputStream	decorateInputStream(com.sun.net.httpserver.HttpExchange exchange, InputStream is) Return the InputStream to use for reading remote invocations, potentially decorating the given original InputStream.
protected OutputStream	decorateOutputStream(com.sun.net.httpserver.HttpExchange exchange, OutputStream os) Return the OutputStream to use for writing remote invocation results, potentially decorating the given original OutputStream.
void	handle(com.sun.net.httpserver.HttpExchange exchange) Reads a remote invocation from the request, executes it, and writes the remote invocation result to the response.
protected RemoteInvocation	readRemoteInvocation(com.sun.net.httpserver.HttpExchange exchange) Read a RemoteInvocation from the given HTTP request.
protected RemoteInvocation	readRemoteInvocation(com.sun.net.httpserver.HttpExchange exchange, InputStream is) Deserialize a RemoteInvocation object from the given InputStream.
protected void	writeRemoteInvocationResult(com.sun.net.httpserver.HttpExchange exchange, RemoteInvocationResult result) Write the given RemoteInvocationResult to the given HTTP response.
protected void	writeRemoteInvocationResult(com.sun.net.httpserver.HttpExchange exchange, RemoteInvocationResult result, OutputStream os) Serialize the given RemoteInvocation to the given OutputStream.

Methods inherited from class org.springframework.remoting.rmi.RemoteInvocationSerializingExporter

afterPropertiesSet, createObjectInputStream, createObjectOutputStream, doReadRemoteInvocation, doWriteRemoteInvocationResult, getContentType, getProxy, isAcceptProxyClasses, prepare, setAcceptProxyClasses, setContentType

Methods inherited from class org.springframework.remoting.support.RemoteInvocationBasedExporter

getRemoteInvocationExecutor, invoke, invokeAndCreateResult, setRemoteInvocationExecutor

Methods inherited from class org.springframework.remoting.support.RemoteExporter

checkService, checkServiceInterface, getExporterName, getProxyForService, getService, getServiceInterface, setInterceptors, setRegisterTraceInterceptor, setService, setServiceInterface

Methods inherited from class org.springframework.remoting.support.RemotingSupport

getBeanClassLoader, overrideThreadContextClassLoader, resetThreadContextClassLoader, setBeanClassLoader

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SimpleHttpInvokerServiceExporter

public SimpleHttpInvokerServiceExporter()

Method Detail

handle

public void handle(com.sun.net.httpserver.HttpExchange exchange)
            throws IOException

Reads a remote invocation from the request, executes it, and writes the remote invocation result to the response.

Specified by:

handle in interface com.sun.net.httpserver.HttpHandler

Throws:

IOException

See Also:

readRemoteInvocation(HttpExchange), RemoteInvocationBasedExporter.invokeAndCreateResult(RemoteInvocation, Object), writeRemoteInvocationResult(HttpExchange, RemoteInvocationResult)

readRemoteInvocation

protected RemoteInvocation readRemoteInvocation(com.sun.net.httpserver.HttpExchange exchange)
                                         throws IOException,
                                                ClassNotFoundException

Read a RemoteInvocation from the given HTTP request.

Delegates to readRemoteInvocation(HttpExchange, InputStream) with the HttpExchange.getRequestBody() request's input stream}.

Parameters:

exchange - current HTTP request/response

Returns:

the RemoteInvocation object

Throws:

IOException - in case of I/O failure

ClassNotFoundException - if thrown by deserialization

readRemoteInvocation

protected RemoteInvocation readRemoteInvocation(com.sun.net.httpserver.HttpExchange exchange,
                                                InputStream is)
                                         throws IOException,
                                                ClassNotFoundException

Deserialize a RemoteInvocation object from the given InputStream.

Gives decorateInputStream(com.sun.net.httpserver.HttpExchange, java.io.InputStream) a chance to decorate the stream first (for example, for custom encryption or compression). Creates a CodebaseAwareObjectInputStream and calls RemoteInvocationSerializingExporter.doReadRemoteInvocation(java.io.ObjectInputStream) to actually read the object.

Can be overridden for custom serialization of the invocation.

Parameters:

exchange - current HTTP request/response

is - the InputStream to read from

Returns:

the RemoteInvocation object

Throws:

IOException - in case of I/O failure

ClassNotFoundException - if thrown during deserialization

decorateInputStream

protected InputStream decorateInputStream(com.sun.net.httpserver.HttpExchange exchange,
                                          InputStream is)
                                   throws IOException

Return the InputStream to use for reading remote invocations, potentially decorating the given original InputStream.

The default implementation returns the given stream as-is. Can be overridden, for example, for custom encryption or compression.

Parameters:

exchange - current HTTP request/response

is - the original InputStream

Returns:

the potentially decorated InputStream

Throws:

IOException - in case of I/O failure

writeRemoteInvocationResult

protected void writeRemoteInvocationResult(com.sun.net.httpserver.HttpExchange exchange,
                                           RemoteInvocationResult result)
                                    throws IOException

Write the given RemoteInvocationResult to the given HTTP response.

Parameters:

exchange - current HTTP request/response

result - the RemoteInvocationResult object

Throws:

IOException - in case of I/O failure

writeRemoteInvocationResult

protected void writeRemoteInvocationResult(com.sun.net.httpserver.HttpExchange exchange,
                                           RemoteInvocationResult result,
                                           OutputStream os)
                                    throws IOException

Serialize the given RemoteInvocation to the given OutputStream.

The default implementation gives decorateOutputStream(com.sun.net.httpserver.HttpExchange, java.io.OutputStream) a chance to decorate the stream first (for example, for custom encryption or compression). Creates an ObjectOutputStream for the final stream and calls RemoteInvocationSerializingExporter.doWriteRemoteInvocationResult(org.springframework.remoting.support.RemoteInvocationResult, java.io.ObjectOutputStream) to actually write the object.

Can be overridden for custom serialization of the invocation.

Parameters:

exchange - current HTTP request/response

result - the RemoteInvocationResult object

os - the OutputStream to write to

Throws:

IOException - in case of I/O failure

See Also:

decorateOutputStream(com.sun.net.httpserver.HttpExchange, java.io.OutputStream), RemoteInvocationSerializingExporter.doWriteRemoteInvocationResult(org.springframework.remoting.support.RemoteInvocationResult, java.io.ObjectOutputStream)

decorateOutputStream

protected OutputStream decorateOutputStream(com.sun.net.httpserver.HttpExchange exchange,
                                            OutputStream os)
                                     throws IOException

Return the OutputStream to use for writing remote invocation results, potentially decorating the given original OutputStream.

The default implementation returns the given stream as-is. Can be overridden, for example, for custom encryption or compression.

Parameters:

exchange - current HTTP request/response

os - the original OutputStream

Returns:

the potentially decorated OutputStream

Throws:

IOException - in case of I/O failure