Java / Servlet Interview Questions
1. What is servlet?
Java Servlet is a server side technologies to extend the capability of web servers by providing support for dynamic response and data persistence.
2. Advantages of Servlet over CGI.
Servlet technology was introduced to overcome the shortcomings of CGI technology. Servlet provide better performance that CGI in terms of processing time, memory utilization because servlets uses benefits of multithreading and for each request a new thread is created, that is faster than loading ...
3. Can we retrieve remote client MAC address from the Servlet request?
No. The Remote client's hardware address cannot be retrieve from the servlet request.
4. How do you logout a session user in servlet?
Calling session.invalidate method logs out the user.
5. How to protect session cookies in Servlet?
For Java EE 6 (Servlet 3.0) the setHttpOnly and setSecure methods can be used to protect HTTP Cookies. For older Java versions, there are no API available to directly set the HttpOnly and Secure flags. The workaround is creating a custom SET-COOKIE header. String sessionId = request.gerSession()....
6. Can we call servlet destroy() from service()?
destroy() is part of servlet life cycle methods, it is used to kill the servlet instance. Servlet Engine is used to call destroy(). In case, if you call destroy method from service(), it just execute the code written in the destroy(), but it wont kill the servlet instance. destroy() will be calle...
7. Difference between out.println and System.out.println in JSP Scriptlet.
out.println prints to the browser and System.out.println() prints to the server console.
8. What happens when JSTL expression encounter NullPointerException?
The condition will be evaluated to false as JSTL suppresses NullPointerException.
9. What are the methods of the HttpServletRequest object often used to implement programmatic authorization checks?
getRemoteUser() returns the login of the users making this request if the user has been authenticated; returns null if the user is not authenticated. isUserInRole() returns a boolean indicating whether the authenticated user is included in the specified role. getUserPrincipal() returns a java.sec...
10. Methods of Java EE container security.
In Java EE, the component containers are responsible for providing application security. A container provides two types of security: declarative and programmatic. Declarative security is the preferred method, which expresses application security requirements via configuration parameters found in ...
11. List a few annotations relevant to container security.
The @ServletSecurity annotation provides an alternative mechanism for defining access control constraints for the whole servlet. These annotations provide an alternative mechanism for specifying security constraints declaratively by elements in the web.xml file. The @DeclareRoles annotation is us...
12. Types of authentication methods.
There are 4 main types. Basic username and password are sent in base64 in HTTP header, sent in cleartext so SSL is needed. Digest MD5 digest of credentials (hashed passwords ) are sent. Form-Based username/passwords are sent in POST body; need SSL. Certifcate-based User sends certificate to the s...
13. Mention important techniques that are used when sending data securely between source and destination over networks.
Message Certification: Mesage data is certified that it has not been modified since it was created by the source. Message Encryption: Parts of a message/entire message may be encrypted during transmission. It is a good choice when data must be protected past the TLS termination point. Tunnel Encr...
14. Common security concerns when building secure servers.
Man in the middle (MITM) attacks: the attacker's proxy is inserted between the client and server to intercept the data. Compromised data may be disclosed or altered depending upon the attacker's goals and technical factors. Weak cipher, X.509 private certificate leakage: Private certificates are ...
15. Security features provided by SOAP messaging standard.
Common web server infrastructure : SOAP services leverage existing web/web service infrastructure, so from a security perspective, IT Operations groups usually know how to configure web servers securely. Dynamic service bindings : SOAP provides descriptive service bindings via WSDL documents. Bin...
16. What should be used to prevent Javascript from accessing a Session ID value?
Set the HttpOnly Flag on the Session ID.
