Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of aw@ice-sa.com designates
 212.85.38.174 as permitted sender)
Message-ID: <498D7ECF.1010801@ice-sa.com>
Date: Sat, 07 Feb 2009 13:30:07 +0100
From: =?UTF-8?B?QW5kcsOpIFdhcm5pZXI=?= <aw@ice-sa.com>
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: TC6 ${CATALINA_HOME}/conf/web.xml Is this the place to constrain
 	the mime type?
References: <711a73df0902050939s40d13915lc539ddc7ebe09753@mail.gmail.com>
	 <0AAE5AB84B013E45A7B61CB66943C17215B611AB00@USEA-EXCH7.na.uis.unisys.com>
	 <27AEFA85-6D12-4A4F-801F-9D92B707EFD5@koberg.com>
	 <711a73df0902051059w6813ae6q8a8d655f8be0ae12@mail.gmail.com>
	 <0AAE5AB84B013E45A7B61CB66943C17215B611AE7A@USEA-EXCH7.na.uis.unisys.com>
	 <711a73df0902060239s1317c7a0vdb120f28cc97ebfb@mail.gmail.com>
	 <0AAE5AB84B013E45A7B61CB66943C17215B614F974@USEA-EXCH7.na.uis.unisys.com>
	 <711a73df0902060624h53f9bbf8vf79e76ad1fd46e26@mail.gmail.com>
	 <498C870D.4040001@ice-sa.com>
 <711a73df0902062311y6949632avc353e97e670e62c4@mail.gmail.com>
In-Reply-To: <711a73df0902062311y6949632avc353e97e670e62c4@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Dave Pawson wrote:
> Rob, Christopher, Andre.
> Thanks for the input.
> As I said to Rob, security is not an issue at the present time.
> There is no value in the content returned by the 'server' / end point;
> I'm not trying to make it secure. Just respond less than
> I otherwise might.
> 
Ok, then let me make one final guess and suggestion.
If the point is just for your server application to avoid wasting time 
sending a response to a client that is not "yours", and which would not 
be able to do something useful with it anyway, then the easiest route 
would probably still be a simple "servlet filter".
That servlet filter would examine the request headers (say the 
"User-Agent" header, which your client would set appropriately), 
determine if it is or not the appropriate client, and if not send an 
appropriate HTTP 4xx error response right away, without even letting the 
request go to the servlet or restlet or whatever.
By sending the correct 4xx kind of response, you would let this "client" 
know right away, without a doubt, that there is no content here for him, 
and that he should not even retry, thus avoiding further waste of time 
for everyone.  Google for "HTTP response codes" to find the most 
appropriate response in your case.

You may even find a ready-made servlet filter that could do that (and 
many other things besides) here :
http://www.tuckey.org/urlrewrite/

A servlet filter does not modify (or require you to modify) the 
application in any way; it just sees the request before your application 
does, and can do something to it before the application sees it; it also 
sees the response of your application after it is produced and can do 
something to it before it is passed to the client.
Also, servlet filters are an entirely portable mechanism, defined in the 
Servlet Specification, so this would work on any servlet engine.

Note again that the above is not in any way a security mechanism, 
because any client can send whatever User-Agent header it very well 
pleases.  But it would be a very HTTP RFC-compliant way of kindly asking 
inappropriate clients to just go away and not come back.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org