How to Tackle Java-Based Simple Web Server Assignments

Handling HTTP Methods: Deep Dive

Once your server starts and listens for incoming connections, it needs to parse requests and handle them properly.

a. GET and HEAD Requests

These are the simplest and usually the first to implement.

GET Request Strategy:

• • Extract the requested path.
• • Locate the file from the document root.
• • Respond with:
• o 200 OK and file contents (for GET),
• o or 404 Not Found if it doesn't exist.

HEAD Request Strategy:

• • Same logic as GET, but do not include the file content.
• • Only return headers like Content-Length, Content-Type.

Common Mistake: Forgetting to differentiate between GET and HEAD. HEAD must not send the body.

b. PUT and DELETE Requests

These require modifying the filesystem.

PUT Implementation:

• • Accept file data from the client.
• • Create or overwrite a file at the requested path.
• • Send back 201 Created or 500 Internal Server Error.

DELETE Implementation:

• • Check if the file exists.
• • Try to delete it.
• • Respond with:
• o 204 No Content on success,
• o 404 Not Found if file doesn't exist,
• o 500 Internal Server Error on failure.

Challenge: Java file I/O permissions vary between OSs. Always log the reason for failure to delete or write a file.

c. Malformed Requests and HTTP 400

Your server should validate the HTTP request line:

GET /index.html HTTP/1.1

If it doesn’t match the expected pattern or uses an unsupported method, return a 400 Bad Request. It’s a common grading point in such assignments.

Advanced Features That Set Your Submission Apart

This section covers the two trickiest requirements: authentication and threading.

a. Implementing Basic Authentication

Workflow:

• • Check for a .password file in the resource's directory.
• • If it exists and no Authorization header is provided:
• o Return 401 Unauthorized with WWW-Authenticate header.
• • If the header is present:
• o Decode the base64 string.
• o Verify credentials against .password.

Gotcha Alert: Many forget to handle the 403 Forbidden when the credentials are incorrect. Don’t skip this nuance.

Use Java’s built-in Base64 utilities to decode the header:

byte[] decodedBytes = Base64.getDecoder().decode(authHeader.split(" ")[1]);
String credentials = new String(decodedBytes, StandardCharsets.UTF_8);
Then, read the .password file line by line to validate.

b. Serving Requests in Threads

Handling each client in its own thread is vital for simulating concurrent web traffic.

Pattern to Use:

• • Main thread listens and accepts connections.
• • Each connection is handed to a Runnable or Callable object.
• • Process the request within that thread.

Avoid shared data between threads unless synchronized. For a simple server, no shared state is ideal.

c. Building a Robust Response Generator

Instead of hardcoding response lines, create utility methods:

This keeps your code clean and makes debugging easier.

Testing, Debugging, and Submission Best Practices

You’ve implemented your server — now prove that it works.

• • Use curl or Postman to send each kind of request (GET, HEAD, PUT, DELETE).
• • Test invalid methods like FOO / HTTP/1.1 and ensure you get a 400.
• • Place .password files in your document root and simulate all 401/403 scenarios.

Use testsite.tar (if provided) to replicate grading conditions. Include a video walkthrough if the submission requires it.

Checklist Before Submission:

• • ✅ Handles all HTTP methods as specified
• • ✅ Sends proper status codes
• • ✅ Parses command-line arguments correctly
• • ✅ Supports threaded request handling
• • ✅Validates .password for protected files
• • ✅ Gracefully handles invalid inputs
• • ✅ Has a README with your name and usage instructions
• • ✅ Submits code on correct Git branch before the deadline