Default servlet mapping for different deployment environments

Question

We want to deploy our application on Tomcat, WebLogic, WebSphere and JBoss. Our application's web.xml needs to contain a mapping to the default servlet.

For Tomcat this servlet is named "default", so our mapping would appear as:

<servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>/js/calendar/flexcal.html</url-pattern>
</servlet-mapping>

But on other platforms it changes (i.e. WebLogic is "FileServlet").

Is there a way to define a conditional mapping that will change depending on what is available? If not how should we approach this issue?

Thanks!

BalusC BalusC · Accepted Answer · 2012-03-23T14:30:28

There is no way.

You should preferably not explicitly map to the container's default servlet in any way. You're not only tight coupling your webapp to the specific container, but until about one year ago, there was also a huge security hole when doing that in Tomcat and clones (JBoss, WebSphere, etc). It enables the attackers to request files (containing possibly sensitive information) in /WEB-INF and /META-INF whenever the default servlet was mapped on a different URL pattern than /. See also issue 50026, reported by yours truly.

Rather map your front controller servlet on a more specific URL pattern instead of /* and create and map a global filter on /* which forwards to either the front controller or continues to the default servlet depending on the current request URI. See for a concrete example also How to access static resources when mapping a global front controller servlet on /*.

Default servlet mapping for different deployment environments

1 Answers