org.springframework.remoting.httpinvoker

Class SimpleHttpInvokerServiceExporter

java.lang.Object

org.springframework.remoting.support.RemotingSupport

org.springframework.remoting.support.RemoteExporter

org.springframework.remoting.support.RemoteInvocationBasedExporter

org.springframework.remoting.rmi.RemoteInvocationSerializingExporter

org.springframework.remoting.httpinvoker.SimpleHttpInvokerServiceExporter

All Implemented Interfaces:

com.sun.net.httpserver.HttpHandler, Aware, BeanClassLoaderAware, InitializingBean

Deprecated.

as of Spring Framework 5.1, in favor of HttpInvokerServiceExporter

@Deprecated
 @UsesSunHttpServer
public class SimpleHttpInvokerServiceExporter
extends RemoteInvocationSerializingExporter
implements com.sun.net.httpserver.HttpHandler

HTTP request handler that exports the specified service bean as HTTP invoker service endpoint, accessible via an HTTP invoker proxy. Designed for Sun's JRE 1.6 HTTP server, implementing the HttpHandler interface.

Deserializes remote invocation objects and serializes remote invocation result objects. Uses Java serialization just like RMI, but provides the same ease of setup as Caucho's HTTP-based Hessian protocol.

HTTP invoker is the recommended protocol for Java-to-Java remoting. It is more powerful and more extensible than Hessian, at the expense of being tied to Java. Nevertheless, it is as easy to set up as Hessian, which is its main advantage compared to RMI.

WARNING: Be aware of vulnerabilities due to unsafe Java deserialization: Manipulated input streams could lead to unwanted code execution on the server during the deserialization step. As a consequence, do not expose HTTP invoker endpoints to untrusted clients but rather just between your own services. In general, we strongly recommend any other message format (e.g. JSON) instead.

Since:

2.5.1

Author:

Juergen Hoeller

See Also:

HttpInvokerClientInterceptor, HttpInvokerProxyFactoryBean

Field Summary

Fields inherited from class org.springframework.remoting.rmi.RemoteInvocationSerializingExporter

CONTENT_TYPE_SERIALIZED_OBJECT

Fields inherited from class org.springframework.remoting.support.RemotingSupport

logger

Constructor Summary

Constructors

Constructor and Description
SimpleHttpInvokerServiceExporter() Deprecated.

Method Summary

Modifier and Type	Method and Description
protected java.io.InputStream	decorateInputStream(com.sun.net.httpserver.HttpExchange exchange, java.io.InputStream is) Deprecated. Return the InputStream to use for reading remote invocations, potentially decorating the given original InputStream.
protected java.io.OutputStream	decorateOutputStream(com.sun.net.httpserver.HttpExchange exchange, java.io.OutputStream os) Deprecated. Return the OutputStream to use for writing remote invocation results, potentially decorating the given original OutputStream.
void	handle(com.sun.net.httpserver.HttpExchange exchange) Deprecated. Reads a remote invocation from the request, executes it, and writes the remote invocation result to the response.
protected RemoteInvocation	readRemoteInvocation(com.sun.net.httpserver.HttpExchange exchange) Deprecated. Read a RemoteInvocation from the given HTTP request.
protected RemoteInvocation	readRemoteInvocation(com.sun.net.httpserver.HttpExchange exchange, java.io.InputStream is) Deprecated. Deserialize a RemoteInvocation object from the given InputStream.
protected void	writeRemoteInvocationResult(com.sun.net.httpserver.HttpExchange exchange, RemoteInvocationResult result) Deprecated. Write the given RemoteInvocationResult to the given HTTP response.
protected void	writeRemoteInvocationResult(com.sun.net.httpserver.HttpExchange exchange, RemoteInvocationResult result, java.io.OutputStream os) Deprecated. Serialize the given RemoteInvocation to the given OutputStream.

Methods inherited from class org.springframework.remoting.rmi.RemoteInvocationSerializingExporter

afterPropertiesSet, createObjectInputStream, createObjectOutputStream, doReadRemoteInvocation, doWriteRemoteInvocationResult, getContentType, getProxy, isAcceptProxyClasses, prepare, setAcceptProxyClasses, setContentType

Methods inherited from class org.springframework.remoting.support.RemoteInvocationBasedExporter

getRemoteInvocationExecutor, invoke, invokeAndCreateResult, setRemoteInvocationExecutor

Methods inherited from class org.springframework.remoting.support.RemoteExporter

checkService, checkServiceInterface, getExporterName, getProxyForService, getService, getServiceInterface, setInterceptors, setRegisterTraceInterceptor, setService, setServiceInterface

Methods inherited from class org.springframework.remoting.support.RemotingSupport

getBeanClassLoader, overrideThreadContextClassLoader, resetThreadContextClassLoader, setBeanClassLoader

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SimpleHttpInvokerServiceExporter

public SimpleHttpInvokerServiceExporter()

Deprecated.

Method Detail

handle

public void handle(com.sun.net.httpserver.HttpExchange exchange)
            throws java.io.IOException

Deprecated.

Reads a remote invocation from the request, executes it, and writes the remote invocation result to the response.

Specified by:

handle in interface com.sun.net.httpserver.HttpHandler

Throws:

java.io.IOException

See Also:

readRemoteInvocation(HttpExchange), RemoteInvocationBasedExporter.invokeAndCreateResult(RemoteInvocation, Object), writeRemoteInvocationResult(HttpExchange, RemoteInvocationResult)

readRemoteInvocation

protected RemoteInvocation readRemoteInvocation(com.sun.net.httpserver.HttpExchange exchange)
                                         throws java.io.IOException,
                                                java.lang.ClassNotFoundException

Deprecated.

Read a RemoteInvocation from the given HTTP request.

Delegates to readRemoteInvocation(HttpExchange, InputStream) with the HttpExchange.getRequestBody() request's input stream}.

Parameters:

exchange - current HTTP request/response

Returns:

the RemoteInvocation object

Throws:

java.io.IOException - in case of I/O failure

java.lang.ClassNotFoundException - if thrown by deserialization

readRemoteInvocation

protected RemoteInvocation readRemoteInvocation(com.sun.net.httpserver.HttpExchange exchange,
                                                java.io.InputStream is)
                                         throws java.io.IOException,
                                                java.lang.ClassNotFoundException

Deprecated.

Deserialize a RemoteInvocation object from the given InputStream.

Gives decorateInputStream(com.sun.net.httpserver.HttpExchange, java.io.InputStream) a chance to decorate the stream first (for example, for custom encryption or compression). Creates a CodebaseAwareObjectInputStream and calls RemoteInvocationSerializingExporter.doReadRemoteInvocation(java.io.ObjectInputStream) to actually read the object.

Can be overridden for custom serialization of the invocation.

Parameters:

exchange - current HTTP request/response

is - the InputStream to read from

Returns:

the RemoteInvocation object

Throws:

java.io.IOException - in case of I/O failure

java.lang.ClassNotFoundException - if thrown during deserialization

decorateInputStream

protected java.io.InputStream decorateInputStream(com.sun.net.httpserver.HttpExchange exchange,
                                                  java.io.InputStream is)
                                           throws java.io.IOException

Deprecated.

Return the InputStream to use for reading remote invocations, potentially decorating the given original InputStream.

The default implementation returns the given stream as-is. Can be overridden, for example, for custom encryption or compression.

Parameters:

exchange - current HTTP request/response

is - the original InputStream

Returns:

the potentially decorated InputStream

Throws:

java.io.IOException - in case of I/O failure

writeRemoteInvocationResult

protected void writeRemoteInvocationResult(com.sun.net.httpserver.HttpExchange exchange,
                                           RemoteInvocationResult result)
                                    throws java.io.IOException

Deprecated.

Write the given RemoteInvocationResult to the given HTTP response.

Parameters:

exchange - current HTTP request/response

result - the RemoteInvocationResult object

Throws:

java.io.IOException - in case of I/O failure

writeRemoteInvocationResult

protected void writeRemoteInvocationResult(com.sun.net.httpserver.HttpExchange exchange,
                                           RemoteInvocationResult result,
                                           java.io.OutputStream os)
                                    throws java.io.IOException

Deprecated.

Serialize the given RemoteInvocation to the given OutputStream.

The default implementation gives decorateOutputStream(com.sun.net.httpserver.HttpExchange, java.io.OutputStream) a chance to decorate the stream first (for example, for custom encryption or compression). Creates an ObjectOutputStream for the final stream and calls RemoteInvocationSerializingExporter.doWriteRemoteInvocationResult(org.springframework.remoting.support.RemoteInvocationResult, java.io.ObjectOutputStream) to actually write the object.

Can be overridden for custom serialization of the invocation.

Parameters:

exchange - current HTTP request/response

result - the RemoteInvocationResult object

os - the OutputStream to write to

Throws:

java.io.IOException - in case of I/O failure

See Also:

decorateOutputStream(com.sun.net.httpserver.HttpExchange, java.io.OutputStream), RemoteInvocationSerializingExporter.doWriteRemoteInvocationResult(org.springframework.remoting.support.RemoteInvocationResult, java.io.ObjectOutputStream)

decorateOutputStream

protected java.io.OutputStream decorateOutputStream(com.sun.net.httpserver.HttpExchange exchange,
                                                    java.io.OutputStream os)
                                             throws java.io.IOException

Deprecated.

Return the OutputStream to use for writing remote invocation results, potentially decorating the given original OutputStream.

The default implementation returns the given stream as-is. Can be overridden, for example, for custom encryption or compression.

Parameters:

exchange - current HTTP request/response

os - the original OutputStream

Returns:

the potentially decorated OutputStream

Throws:

java.io.IOException - in case of I/O failure