org.springframework.remoting.httpinvoker

Class HttpInvokerClientInterceptor

java.lang.Object

org.springframework.remoting.support.RemotingSupport

org.springframework.remoting.support.RemoteAccessor

org.springframework.remoting.support.UrlBasedRemoteAccessor

org.springframework.remoting.support.RemoteInvocationBasedAccessor

org.springframework.remoting.httpinvoker.HttpInvokerClientInterceptor

All Implemented Interfaces:

org.aopalliance.aop.Advice, org.aopalliance.intercept.Interceptor, org.aopalliance.intercept.MethodInterceptor, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanClassLoaderAware, org.springframework.beans.factory.InitializingBean, HttpInvokerClientConfiguration

Direct Known Subclasses:

HttpInvokerProxyFactoryBean

public class HttpInvokerClientInterceptor
extends org.springframework.remoting.support.RemoteInvocationBasedAccessor
implements org.aopalliance.intercept.MethodInterceptor, HttpInvokerClientConfiguration

MethodInterceptor for accessing an HTTP invoker service. The service URL must be an HTTP URL exposing an HTTP invoker service.

Serializes remote invocation objects and deserializes remote invocation result objects. Uses Java serialization just like RMI, but provides the same ease of setup as Caucho's HTTP-based Hessian and Burlap protocols.

HTTP invoker is a very extensible and customizable protocol. It supports the RemoteInvocationFactory mechanism, like RMI invoker, allowing to include additional invocation attributes (for example, a security context). Furthermore, it allows to customize request execution via the HttpInvokerRequestExecutor strategy.

Can use the JDK's RMIClassLoader to load classes from a given codebase, performing on-demand dynamic code download from a remote location. The codebase can consist of multiple URLs, separated by spaces. Note that RMIClassLoader requires a SecurityManager to be set, analogous to when using dynamic class download with standard RMI! (See the RMI documentation for details.)

WARNING: Be aware of vulnerabilities due to unsafe Java deserialization: Manipulated input streams could lead to unwanted code execution on the server during the deserialization step. As a consequence, do not expose HTTP invoker endpoints to untrusted clients but rather just between your own services. In general, we strongly recommend any other message format (e.g. JSON) instead.

Since:

1.1

Author:

Juergen Hoeller

See Also:

UrlBasedRemoteAccessor.setServiceUrl(java.lang.String), setCodebaseUrl(java.lang.String), RemoteInvocationBasedAccessor.setRemoteInvocationFactory(org.springframework.remoting.support.RemoteInvocationFactory), setHttpInvokerRequestExecutor(org.springframework.remoting.httpinvoker.HttpInvokerRequestExecutor), HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, RMIClassLoader

Field Summary

Fields inherited from class org.springframework.remoting.support.RemotingSupport

logger

Constructor Summary

Constructors

Constructor and Description
HttpInvokerClientInterceptor()

Method Summary

Modifier and Type	Method and Description
void	afterPropertiesSet()
protected org.springframework.remoting.RemoteAccessException	convertHttpInvokerAccessException(Throwable ex) Convert the given HTTP invoker access exception to an appropriate Spring RemoteAccessException.
protected org.springframework.remoting.support.RemoteInvocationResult	executeRequest(org.springframework.remoting.support.RemoteInvocation invocation) Execute the given remote invocation via the HttpInvokerRequestExecutor.
protected org.springframework.remoting.support.RemoteInvocationResult	executeRequest(org.springframework.remoting.support.RemoteInvocation invocation, org.aopalliance.intercept.MethodInvocation originalInvocation) Execute the given remote invocation via the HttpInvokerRequestExecutor.
String	getCodebaseUrl() Return the codebase URL to download classes from if not found locally.
HttpInvokerRequestExecutor	getHttpInvokerRequestExecutor() Return the HttpInvokerRequestExecutor used by this remote accessor.
Object	invoke(org.aopalliance.intercept.MethodInvocation methodInvocation)
void	setCodebaseUrl(String codebaseUrl) Set the codebase URL to download classes from if not found locally.
void	setHttpInvokerRequestExecutor(HttpInvokerRequestExecutor httpInvokerRequestExecutor) Set the HttpInvokerRequestExecutor implementation to use for executing remote invocations.

Methods inherited from class org.springframework.remoting.support.RemoteInvocationBasedAccessor

createRemoteInvocation, getRemoteInvocationFactory, recreateRemoteInvocationResult, setRemoteInvocationFactory

Methods inherited from class org.springframework.remoting.support.UrlBasedRemoteAccessor

getServiceUrl, setServiceUrl

Methods inherited from class org.springframework.remoting.support.RemoteAccessor

getServiceInterface, setServiceInterface

Methods inherited from class org.springframework.remoting.support.RemotingSupport

getBeanClassLoader, overrideThreadContextClassLoader, resetThreadContextClassLoader, setBeanClassLoader

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.springframework.remoting.httpinvoker.HttpInvokerClientConfiguration

getServiceUrl

Constructor Detail

HttpInvokerClientInterceptor

public HttpInvokerClientInterceptor()

Method Detail

setCodebaseUrl

public void setCodebaseUrl(String codebaseUrl)

Set the codebase URL to download classes from if not found locally. Can consists of multiple URLs, separated by spaces.

Follows RMI's codebase conventions for dynamic class download. In contrast to RMI, where the server determines the URL for class download (via the "java.rmi.server.codebase" system property), it's the client that determines the codebase URL here. The server will usually be the same as for the service URL, just pointing to a different path there.

See Also:

UrlBasedRemoteAccessor.setServiceUrl(java.lang.String), CodebaseAwareObjectInputStream, RMIClassLoader

getCodebaseUrl

public String getCodebaseUrl()

Return the codebase URL to download classes from if not found locally.

Specified by:

getCodebaseUrl in interface HttpInvokerClientConfiguration

Returns:

the codebase URL, or null if none

See Also:

RMIClassLoader

setHttpInvokerRequestExecutor

public void setHttpInvokerRequestExecutor(HttpInvokerRequestExecutor httpInvokerRequestExecutor)

Set the HttpInvokerRequestExecutor implementation to use for executing remote invocations.

Default is SimpleHttpInvokerRequestExecutor. Alternatively, consider using HttpComponentsHttpInvokerRequestExecutor for more sophisticated needs.

See Also:

SimpleHttpInvokerRequestExecutor, HttpComponentsHttpInvokerRequestExecutor

getHttpInvokerRequestExecutor

public HttpInvokerRequestExecutor getHttpInvokerRequestExecutor()

Return the HttpInvokerRequestExecutor used by this remote accessor.

Creates a default SimpleHttpInvokerRequestExecutor if no executor has been initialized already.

afterPropertiesSet

public void afterPropertiesSet()

Specified by:

afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

Overrides:

afterPropertiesSet in class org.springframework.remoting.support.UrlBasedRemoteAccessor

invoke

public Object invoke(org.aopalliance.intercept.MethodInvocation methodInvocation)
              throws Throwable

Specified by:

invoke in interface org.aopalliance.intercept.MethodInterceptor

Throws:

Throwable

executeRequest

protected org.springframework.remoting.support.RemoteInvocationResult executeRequest(org.springframework.remoting.support.RemoteInvocation invocation,
                                                                                     org.aopalliance.intercept.MethodInvocation originalInvocation)
                                                                              throws Exception

Execute the given remote invocation via the HttpInvokerRequestExecutor.

This implementation delegates to executeRequest(RemoteInvocation). Can be overridden to react to the specific original MethodInvocation.

Parameters:

invocation - the RemoteInvocation to execute

originalInvocation - the original MethodInvocation (can e.g. be cast to the ProxyMethodInvocation interface for accessing user attributes)

Returns:

the RemoteInvocationResult object

Throws:

Exception - in case of errors

executeRequest

protected org.springframework.remoting.support.RemoteInvocationResult executeRequest(org.springframework.remoting.support.RemoteInvocation invocation)
                                                                              throws Exception

Execute the given remote invocation via the HttpInvokerRequestExecutor.

Can be overridden in subclasses to pass a different configuration object to the executor. Alternatively, add further configuration properties in a subclass of this accessor: By default, the accessor passed itself as configuration object to the executor.

Parameters:

invocation - the RemoteInvocation to execute

Returns:

the RemoteInvocationResult object

Throws:

IOException - if thrown by I/O operations

ClassNotFoundException - if thrown during deserialization

Exception - in case of general errors

See Also:

getHttpInvokerRequestExecutor(), HttpInvokerClientConfiguration

convertHttpInvokerAccessException

protected org.springframework.remoting.RemoteAccessException convertHttpInvokerAccessException(Throwable ex)

Convert the given HTTP invoker access exception to an appropriate Spring RemoteAccessException.

Parameters:

ex - the exception to convert

Returns:

the RemoteAccessException to throw, or null to have the original exception propagated to the caller