What is the difference between encodeURL and encodeRedirectURL?

Question

I saw an existing question: Difference between encodeURL and encodeRedirectURL . But he does not answer this question. In my testing, these two methods are similar to the same. No matter what I use for print or sendRedirect , they both work fine.

So is there any difference? I want to see the source code, so maybe I can find the difference, but HttpServletResponse is an interface without implementation. Where is the implementation code?

Answer 1

but HttpServletResponse is an interface without implementation. Where is the implementation code?

This is the servletcontainer itself, which is a specific implementation of the servlet API. In the case of, for example, Apache Tomcat, the specific implementation is org.apache.catalina.connector.Response . Here are excerpts of relevance:

  1128 /** 1129 * Encode the session identifier associated with this response 1130 * into the specified redirect URL, if necessary. 1131 * 1132 * @param url URL to be encoded 1133 */ 1134 public String encodeRedirectURL(String url) { 1135 1136 if (isEncodeable(toAbsolute(url))) { 1137 return (toEncoded(url, request.getSessionInternal().getIdInternal())); 1138 } else { 1139 return (url); 1140 } 1141 1142 } 

  1159 /** 1160 * Encode the session identifier associated with this response 1161 * into the specified URL, if necessary. 1162 * 1163 * @param url URL to be encoded 1164 */ 1165 public String encodeURL(String url) { 1166 1167 String absolute = toAbsolute(url); 1168 if (isEncodeable(absolute)) { 1169 // W3c spec clearly said 1170 if (url.equalsIgnoreCase("")){ 1171 url = absolute; 1172 } 1173 return (toEncoded(url, request.getSessionInternal().getIdInternal())); 1174 } else { 1175 return (url); 1176 } 1177 1178 } 

The difference is very subtle. encodeURL() uses the full absolute URL whenever the given (relative) URL is empty.

Answer 2

These two methods can only give different results when your application container uses URL parameters to pass the session identifier. Since almost everyone uses Cookies for this on this day, it is unlikely that you will see a difference in your regular testing.

To force session IDs in URLs, deactivate session cookie settings in your browser (and hope your application server detects this fact) or explicitly include session IDs in the URLs of your application server.

Answer 3

I looked and looked for the answer, I knew that I would find it in stackoverflow or coderanch, and there I found the answer from Charles Lyons, the author of the book in my hands right now it was a fun coincidence.

published on 8/9/2008 11:41 That the encodeURL always writes the session identifier to the URL (if required, for example, since cookies are disabled), while encodeRedirectURL contains additional logic to determine if it is desirable to record the session identifier in. It is a really bad idea to provide foreign sites with a session identifier, for example, since then they can impersonate a user session. hence encodeRedirectURL will put jsessionid in the url if that url is in the current web application and does not rewrite otherwise.

Charles Lyon (SCJP 1.4, April 2003, SCJP 5, December 2006, SCWCD 1.4b, April 2004) Author of the OCEJWCD Study Companion for Oracle Exam 1Z0-899 (ISBN 0955160340)

I also found this answer , which was published earlier,

Posted on 4/19/2006 8:02 AM Quote Post to moderator Hi,

EncodeURL is used to encode URLs to track the session in advance and enable the mechanism. EncodeRedirectURL encodes the specified URL for use in the sendRedirect method.

The main difference between the two: implementation The encodeRedirectURL method includes logic to determine if the session identifier should be encoded in the URL if you redirect the URL to a different context where session information is not required or is invalid. The encodeURL method does not add seeion id if cookies are enabled. In addition to this, encodeRedirectURL does not add session information if the URL is redirected to another context (web application). Since the rules for making this definition may differ from the rules used to decide whether to encode a normal link, this method is separete from the encodeURL method.

Hope this helps you.

thanks

Narendra Dhande