From: Joe Pluta
Now, you won't like this solution because it doesn't fit some arbitrary
checkmark you read on the Internet, but the truth is, what percentage of
your pages do you need to be deeplinked? It's a nice to have, not a
show stopper, and there's a workaround.
And just so you don't get the wrong idea, Aaron, I'm not trying to ignore
the issue, I'm just trying to position it correctly. Also, I'm trying to
correctly identify the problem: is it bookmarking or deeplinking that has
you worried? Because most business sites don't allow bookmarking (except in
the storefront phase, which is anonymous anyway), and in fact precious few
allow deeplinking. You have to enter your UPS tracking number, and Verizon
makes me log in to see my bill.
But let's take your business issue. If we are indeed talking deeplink as
opposed to hyperlink, what you want is a programmatically generated URL that
will get a user to a specific page. Now, I DON'T like using GET URLs for
that purpose, primarily because they require both the name of the JSP as
well as the name of every parameter. They bind the application to the
external link and they invite hacking.
Instead, what I'd do in your case is use a GUID. The GUID would be a key to
a page name and a set of request attributes. There would be a single
traffic cop servlet that would get the request, authenticate the user,
establish the session, set the parameters and forward to the page.
One solid application reason for this would be to make sure that any
application initialization got done correctly. A problem with deeplinking
is ensuring that all the previous steps that led to that point have been
appropriately set up. With a controller servlet (we call it the traffic
cop) you can do just that.
That way, you mail out the request ID. Even if someone gets their hands on
it, no information is actually sent out, and nobody can try to hack into it.
Also, if the JSP name changes, the traffic cop handles it and the request ID
(i.e., the link) is not outdated. Anyone who has used IBM's Infocenter
knows the pain of outdated deeplinks.
My point to all this? It's rare that a specific technical implementation
will stop a business application. Getting caught up in reading some
blogger's opinion on what is good and bad about a technology doesn't even
compare to getting your hands dirty with the real code. If you properly
identify the business requirement and you understand the underlying
technology, it's likely that you can figure out a way to do what you need.
I consider this deeplinking to be outside the realm of JSF since it's so
rare in today's world, but if you do need it, I've just outlined a very
simple technique to do it.
Joe
midrange.com
