Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [jetty-dev] javax.servlet / jakarta.servlet support
Hi Joakim,

Thanks for the fast response. Given the drawbacks, what where the reasons for Jetty to bring back support for EE8?

As part of our analysis, we looked at all other dependencies in our project. None of them depend on the servlet API. The only consumer of the servlet API in our system is Jetty itself. To me, that takes away much of the risk of us not being able to update other dependencies (if their updated versions have migrated to Jakarta) to pull in security updates, if we'd choose to stick with EE8.

Our usage is mostly based on a non-public administrative console that consists of JSPs generating flat HTML (which still uses tables for layout, to give you an idea). There are some public endpoints too, like the ones offering websocket connectivity to our chat solution, as well as some bundled web-applications that implement a chat client. I don't expect us to require cutting-edge browser features anywhere soon though, although I will also admit that I'm not quite in the loop exactly what changes we'd be missing out on. You've mentioned two (Same-Site on Set-Cookie and HTTP/2 push). Does there happen to exist a more or less finite list of 'modern browser thingies' not compatible with EE8?

Thanks again!

  - Guus

On Thu, Nov 7, 2024 at 5:33 PM Joakim Erdfelt via jetty-dev <jetty-dev@xxxxxxxxxxx> wrote:
The modern browsers (chrome, chromium based, firefox, etc) tend to add/change/remove features that are incompatible with the ee8 servlet spec.
They add extra required concepts (like Same-Site on Set-Cookie).
Or they remove features (like HTTP/2 push).  

These concepts brew for a few years before becoming mainstream features of the browsers.
By the time those changes are public, a new Servlet API is released that supports those features properly (by either adding APIs or removing APIs on the servlet API).

This is just scratching the surface, these kinds of things are happening with more and more frequency today.
- Joakim

On Thu, Nov 7, 2024 at 10:25 AM Guillaume Maillard via jetty-dev <jetty-dev@xxxxxxxxxxx> wrote:
Hi Joakim,

Could you elaborate a bit on "browsers are not compatible with the old ee8 servlet api" ?

Regards,

Guillaume


Le jeu. 7 nov. 2024 à 16:48, Joakim Erdfelt via jetty-dev <jetty-dev@xxxxxxxxxxx> a écrit :
There are no plans for dropping ee8 support.

The only plans we have internally is related to how we build / maintain the ee8 support.
Eg: one proposal is that we take the ee# levels out of mainline into a new repository with branches for each ee#, making the mainline code tree just reference those via git submodules.  This would help us maintain code changes across the ee# branches with simple git merge tooling.  (This is just a proposal at this point in time, and we are focused on getting 12.1.0 out the door before we make any kind of change like this).

But, that being said, you should know that sticking with `javax.servlet` is already going to be difficult when it comes to interop with modern browsers.
New features being introduced in the browsers are not compatible with the old ee8 servlet api, and any kind of support for those modern browsers will mean proprietary apis or hacks to get them to work in ee8.
The fact that most libraries that support javax.servlet have stopped updates (including security updates) or reached end-of-life for those versions is another nail in the coffin for javax.servlet.

If you plan on supporting things on the public internet, or modern web browsers, then it would be in your best interest to migrate your webapp to jakarta.servlet when you can.
Yes, we know it's more difficult than upgrading from Java 8 to Java 9, but it's not something you can avoid in the long term.

If you have a totally in-house webapp, not exposed to the internet, and no modern web browser will connect to it, then stay with ee8 if you want.  The only pressure you have to update to jakarta.servlet is lack of support and security updates from your third party dependencies that use javax.servlet.

- Joakim

On Thu, Nov 7, 2024 at 6:37 AM Guus der Kinderen via jetty-dev <jetty-dev@xxxxxxxxxxx> wrote:
Hello Jetty Team!

In Jetty 11, support for the javax.servlet namespace was dropped, and replaced by the jakarta.servlet namespace.

With Jetty 12, support for the javax.servlet namespace is re-introduced, giving users the option to use either javax.servlet or jakarta.servlet through offering jetty builds for the EE8, EE9 and EE10 environments. I can only assume that this was quite the undertaking. Thanks!

Can you please share the motivation for the re-introduction of the javax.servlet namespace?

I'd also love to learn about your roadmap. How do you see (if you have such a vision today) EE support in future versions of Jetty? Specifically, do you expect continued support for EE8 / the javax.servlet namespace?

Kind regards,

  Guus
_______________________________________________
jetty-dev mailing list
jetty-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-dev
_______________________________________________
jetty-dev mailing list
jetty-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-dev
_______________________________________________
jetty-dev mailing list
jetty-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-dev
_______________________________________________
jetty-dev mailing list
jetty-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-dev

Back to the top