« Web Security Improvement Ideas | Main | Major updates to ModSecurity in 1.9dev3 »

Improvements to the Servlet specification

Posted by ivanr on August 08, 2005.

A while ago Greg Murray (the Servlet specification lead) asked for ideas for Servlet improvements. I generally like the Servlet specification, but it seems that it is easy to encounter its limitations if you are trying to do things others have not tried before. My ideas for improvements come from my work on the Java version of ModSecurity (still work in progress):

• Server-wide filters/plugins. Servlet filters are a pretty capable technology but they are an application-level feature. I think it's ironic that we can add plug-ins to applications but that we still don't have a plug-in standard for Java web servers.

• Server-controlled buffering. Right now it is the application that controls buffering. In some cases (for example when you want to screen all output for security reasons) it is necessary to force buffering upon an application. This is possible to do now, with a filter, but it's not very efficient since buffering is done twice - once in the container and once in the filter. A configuration switch to enforce buffering, together with ability to have direct access to the buffer in the container would possibly offer significant performance enhancements.
  

Posted by ivanr at August 8, 2005 11:21 AM