�ݺ�ߣ

Intro into MVC 1.0
Maurice de Chateau
June 9, 2016

Agenda
● Why another MVC?
● The specification
– Models, Views and Controllers
– Exception handling
– MVC applications
– Security
– Events
● Current status

Why another MVC?
● We already have JSF
– Component-based MVC (“MVC-pull”)
● No action-based MVC yet (“MVC-push”)
– Java EE 8 community survey indicated the need
● Different approach, “mental model”
– Which one is “more suitable”, not “better”

Why another MVC?
Properties of UI component orientation:
● Readily available UI components from various libraries
● Easy-to-use development model with quick results
● Little control over and access to HTML, CSS, JS and
HTTP
● Hard to combine with other technologies
● Difficult to fully understand (e.g. JSF lifecycle)

Why another MVC?
Properties of action orientation:
● Does not hide the HTTP request/response mechanism
● Makes few assumptions (if any) about the UI, does not
dictate HTML/CSS/JS
● Has the developer explicitly deal with events that
originate from the UI

MVC 1.0
● Built on top of JAX-RS
● Integrates with CDI and Bean Validation
● Built-in support for JSP and facelets
– But others template engines may be supported
– Ozark e.g. supports FreeMarker, Thymeleaf and
Handlebars

Models, Views and Controllers
●
javax.mvc.Models: map between names and
objects
● Optional: CDI-based models (@Named)
@Named@Named("greeting")("greeting")
@RequestScoped@RequestScoped
public class Greeting {public class Greeting {
    private String message;private String message;
    public String getMessage() { ... }public String getMessage() { ... }
    public void setMessage(String message) { ... }public void setMessage(String message) { ... }
......
}}
@Named@Named("greeting")("greeting")
@RequestScoped@RequestScoped
public class Greeting {public class Greeting {
    private String message;private String message;
    public String getMessage() { ... }public String getMessage() { ... }
    public void setMessage(String message) { ... }public void setMessage(String message) { ... }
......
}}
@Inject@Inject
private private ModelsModels models; models;
@Inject@Inject
private private ModelsModels models; models;
models.models.putput("greeting", new Greeting("Hello there!");("greeting", new Greeting("Hello there!");models.models.putput("greeting", new Greeting("Hello there!");("greeting", new Greeting("Hello there!");

● Rendered by a supported view engine
– JSPs and Facelets mandatory
● Located in /WEBINF/views
The message property is read from the greeting model, whose name was either
specified in a @Named annotation or used as a key in the Models map
<%@ page contentType="text/html;charset=UTF8" language="java" %><%@ page contentType="text/html;charset=UTF8" language="java" %>
<!DOCTYPE html><!DOCTYPE html>
<html><html>
    <head><head>
        <title>Hello</title><title>Hello</title>
    </head></head>
    <body><body>
        <h1>${greeting.message}</h1><h1>${greeting.message}</h1>
    </body></body>
</html></html>
<%@ page contentType="text/html;charset=UTF8" language="java" %><%@ page contentType="text/html;charset=UTF8" language="java" %>
<!DOCTYPE html><!DOCTYPE html>
<html><html>
    <head><head>
        <title>Hello</title><title>Hello</title>
    </head></head>
    <body><body>
        <h1>${greeting.message}</h1><h1>${greeting.message}</h1>
    </body></body>
</html></html>

● An MVC controller is a JAX-RS resource method
decorated by @Controller
●
@Controller can also be applied at class level:
it then applies to all resource methods in that class
● A controller method may return any of
void (with @View), String, javax.mvc.Viewable, Response,
or any other Java type for which the toString method
returns a view path.

● Simple example:
@Path("hello")@Path("hello")
public class HelloController {public class HelloController {
    @Inject@Inject
    private Models models;private Models models;
    @GET@GET
    @Controller@Controller
    public String hello() {public String hello() {
        models.put("greeting", new Greeting("Hello there!");models.put("greeting", new Greeting("Hello there!");
        return "hello.jsp";return "hello.jsp";
    }}
}}
@Path("hello")@Path("hello")
public class HelloController {public class HelloController {
    @Inject@Inject
    private Models models;private Models models;
    @GET@GET
    public String hello() {public String hello() {
        models.put("greeting", new Greeting("Hello there!");models.put("greeting", new Greeting("Hello there!");
        return "hello.jsp";return "hello.jsp";
    }}
}}

● Unlike JAX-RS resource classes, classes with MVC
controllers must be CDI-managed beans
●
@View: for void methods, but also to define the default
view path when null is returned
●
Viewable: encapsulates info about a view path
– Contains a reference to a Models object (optional)
– Contains a reference to a ViewEngine object (optional)

● Support for redirect: prefix (POST-redirect-GET)
can be rewritten as the equivalent:
● New CDI scope for this: @RedirectScoped
– to share the model between the POST and GET
requests
return Response.seeOther(URI.create("see/here")).build();return Response.seeOther(URI.create("see/here")).build();return Response.seeOther(URI.create("see/here")).build();return Response.seeOther(URI.create("see/here")).build();
return "redirect:see/here";return "redirect:see/here";return "redirect:see/here";return "redirect:see/here";

Exception Handling
● Based on JAX-RS, with additional support for handling binding and
validation exceptions
● Coarse grained: implement ExceptionMapper for all occurrences of
a specific type
● Finer grained, per @Controller method:
– Inject BindingResult into surrounding class
– Annotate method with @ValidateOnExecution
– BindingResult gives access to detailed information about any violations

Exception Handling
@Path("form")@Path("form")
public class FormController {public class FormController {
    @Inject@Inject
    private private BindingResultBindingResult br; br;
    @Inject@Inject
    private ErrorDataBean error;private ErrorDataBean error;
    @POST@POST
    @ValidateOnExecution(type = ExecutableType.NONE)@ValidateOnExecution(type = ExecutableType.NONE)
    public Response formPost(@Valid @BeanParam FormDataBean form) {public Response formPost(@Valid @BeanParam FormDataBean form) {
        if (if (br.isFailed()br.isFailed()) {) {
            // fill out ErrorDataBean ...// fill out ErrorDataBean ...
            return Response.status(BAD_REQUEST).entity("error.jsp").build();return Response.status(BAD_REQUEST).entity("error.jsp").build();
        }}
        return Response.status(OK).entity("data.jsp").build();return Response.status(OK).entity("data.jsp").build();
    }}
}}
@Path("form")@Path("form")
public class FormController {public class FormController {
    @Inject@Inject
    private private BindingResultBindingResult br; br;
    @Inject@Inject
    private ErrorDataBean error;private ErrorDataBean error;
    @POST@POST
    @ValidateOnExecution(type = ExecutableType.NONE)@ValidateOnExecution(type = ExecutableType.NONE)
    public Response formPost(@Valid @BeanParam FormDataBean form) {public Response formPost(@Valid @BeanParam FormDataBean form) {
        if (if (br.isFailed()br.isFailed()) {) {
            // fill out ErrorDataBean ...// fill out ErrorDataBean ...
            return Response.status(BAD_REQUEST).entity("error.jsp").build();return Response.status(BAD_REQUEST).entity("error.jsp").build();
        }}
        return Response.status(OK).entity("data.jsp").build();return Response.status(OK).entity("data.jsp").build();
    }}
}}

MVC Applications
● MVC application == JAX-RS application +
one or more @Controllers
●
MvcContext: provides contextual information
– context and application paths
– access to the JAX-RS application configuration
object
– access to the security-related beans

Security
● Built-in support for CSRF protection
– Using the Csrf object (in the MvcContext) and
an @CsrfValid annotation (and some config)
– Tokens as form fields, or as HTTP headers
<form action="csrf" method="post"><form action="csrf" method="post">
    <input type="submit" value="Click here"/><input type="submit" value="Click here"/>
    <input type="hidden" name="${<input type="hidden" name="${mvc.csrf.namemvc.csrf.name}"}"
                                              value="${value="${mvc.csrf.tokenmvc.csrf.token}"/>}"/>
</form></form>
<form action="csrf" method="post"><form action="csrf" method="post">
    <input type="submit" value="Click here"/><input type="submit" value="Click here"/>
    <input type="hidden" name="${<input type="hidden" name="${mvc.csrf.namemvc.csrf.name}"}"
                                              value="${value="${mvc.csrf.tokenmvc.csrf.token}"/>}"/>
</form></form>
@POST@POST
@CsrfValid@CsrfValid
public void postForm(...) {public void postForm(...) {
    ......
}}
@POST@POST
@CsrfValid@CsrfValid
public void postForm(...) {public void postForm(...) {
    ......
}}

Security
● Support for encoding to avoid XSS attacks
– For HTML and Javascript
@Inject@Inject
private MvcContext mvcCtx;private MvcContext mvcCtx;
@POST@POST
public void postForm(@FormParam(“input”) String input) {public void postForm(@FormParam(“input”) String input) {
    String escaped = mvcCtx.String escaped = mvcCtx.getEncoders()getEncoders().html(input);.html(input);
    ... ...
}}
@Inject@Inject
private MvcContext mvcCtx;private MvcContext mvcCtx;
@POST@POST
public void postForm(@FormParam(“input”) String input) {public void postForm(@FormParam(“input”) String input) {
    String escaped = mvcCtx.String escaped = mvcCtx.getEncoders()getEncoders().html(input);.html(input);
    ... ...
}}

Events
●
CDI events fired by implementations, observable by applications
– Synchronous!
●
Around a call to a controller:
BeforeControllerEvent, AfterControllerEvent
●
When a controller returns a redirect (HTTP 3xx) status:
ControllerRedirectEvent
●
Around the processView call to the view engine:
BeforeProcessViewEvent, AfterProcessViewEvent

Current status
● Released:
– MVC spec: Early Draft Review 2
– Ozark RI: Milestone 2
● Planning:
– Spec: Public Review → Q1 2016 (!)
(currently only 1 of 11 issues has been resolved!)
Proposed Final Draft → Q3 2016
Final Release → H1 2017
– Ozark: Milestone 3 → June 30, 2016
(but: currently only 16 of 25 issues have been resolved)

References
● JSR 371: Model-View-Controller (MVC 1.0)
Specification
https://jcp.org/en/jsr/detail?id=371
● Ozark – Reference implementation for MVC 1.0
https://ozark.java.net/
● Why another MVC? By Ed Burns
http://www.oracle.com/technetwork/articles/java/mvc-2280472.html
● MVC 1.0 Users Mailing list
https://java.net/projects/mvc-spec/lists/users/archive

Thank you!
Maurice de Chateau
maurice@jpoint.nl
@mauricedchateau

�ݺ�ߣ

Intro into MVC 1.0

More Related Content

Intro into MVC 1.0