Invoker Servlet

The Invoker servlet (or InvokerServlet) is a special servlet provided with Tomcat, which allows servlets to be called by simply using a /servlet URL, without having to configure each servlet individually in web.xml. It is disabled by default in new Tomcat installations and new Metawerx hosting accounts.

For example:

Why does it exist?

In older servlet containers, before web.xml was added to the specification, this was the default behaviour, so the Invoker Servlet was provided to avoid creating complex web.xml files.

Why is it disabled by default?

  • The /servlet/ URL extension allows any class in your classpath to be accessed, as long as the class is a valid servlet. This is a security risk. Using web.xml configuration, the deployer of the application can define specifically which URL's can be used.
  • Secondly, the /servlet/ approach forces the use of java class names in the URL. Using web.xml configuration provides a way to define the URL instead, separating the class names from what the end-user sees in their browser's URL bar.

Enabling the Invoker

  • The Invoker is disabled by default, so it is necessary to change either the server-wide web.xml file, or add a small section to your applications web.xml (preferred method). To see how to do this, see Enabling the Invoker Servlet.

Usage tips

  • The servlet name in the URL is the same as the servlet class name.
  • The servlet should not be included in a package if you are planning on using it with the Invoker.

See Also

metawerx specific

referring pages