1. 3/23/01EMTM 5531 EMTM 553: E-commerce Systems Lecture 3: Software Insup Lee Department of Computer and Information Science University of Pennsylvania lee@cis.upenn.edu www.cis.upenn.edu/~lee

2. 3/23/01EMTM 5532 Background Simple view of the original WWW –Web servers stored pages coded in HTML in their file systems. –Pages retrieved by browsers using HTTP. –The URL of a page was the hostname of the server plus the filename of the document. Later, it was realized that –HTML Web pages could be produced by programs as well as stored as files. –URL specifies the hostname of the server, the name of the program to run, and arguments for that program.

3. 3/23/01EMTM 5533 Static content This is a web page. This is a web page. http request server response Browser interprets html page Web server fetch the page

4. 3/23/01EMTM 5534 Dynamic content Hello World. http request server response Browser interprets html page Web server fetch the page Hello World. Interpret php code

5. 3/23/01EMTM 5535 Stateless vs. state Stateless server –The user request a document, and then another document, and so on. –Natural for large number of browsers and small number of servers. Why? –If stateful, it can increase performance. However, oOn server crash, it looses all its volatile state information oOn client crash, the server needs to know to claim state space.

6. 3/23/01EMTM 5536 Session User Session –A delimited set of user clicks across one or more Web servers (for multiple Web page requests) Server Session –A collection of user clicks to a Web server during a user session Why sessions are important? –Complex pages require many connections –High overhead for establishing a connection due to privacy and authentication requirements –E-commerce applications require a series of actions by the user and the server.

7. 3/23/01EMTM 5537 Where to keep state for client? How to identify sets of user requests as belong to the same session and for passing state information back and forth between client and server –State is the application information itself –A session id is a reference to state stored somewhere else. Server-side vs. client-side –Database on server –Applications on server –Cookie on client What are tradeoffs?

8. 3/23/01EMTM 5538 Session and Client state mechanism Techniques –Cookies oData sent by a Web server to a Web client, to be stored locally by the client and sent back to the server on subsequent requests oCookies are stored as small file in a client machine –Date and time, user id, password, etc. –Authentication mechanisms such as client certificate oUsed this to identify the user to the server on each request to use state stored in application database –Forms: state or session id can passed as hidden fields –Applets: client scripting can be used to store session id or state

9. 3/23/01EMTM 5539 Active Web Sites Allow the user to be sent customized pages Support dynamic browsing experience Built using with a combination of languages and technologies –Client-side technologies oUsed for detecting browser features, responding to user actions, validating form data, displaying dialog boxes. oAdv: reduce network traffic, server load, almost instant response to user actions –Server-side technologies

10. 3/23/01EMTM 55310 Client-side technologies ActiveX controls –Self-contained program called components written in C++ or Visual Basic can be called – tag: can used for bar charts, graphics, timers, client authentication, database access –Developed by Microsoft Client-side JavaScript and Dynamic HTML –JavaScript supported by both IE and Netscape Navigator –Dynamic HTML is like script plus abilities to animate pages and position graphics. Java Applets –Advantage of Java: stand alone, cross platform, safe.

11. 3/23/01EMTM 55311 Java An object-oriented language developed by Sun Microsystems Java programs are compiled into Java bytecode, which are executed by JVM (Java virtual machine) Write-once run-anyway Security of Java applets is based on a sandbox model

12. 3/23/01EMTM 55312 Java Applets Web-Server HTTP-Request HTML-page Web-Server File-System Load File File Load Applet... Java-Class Requests Java-Classes Execute Applet... Java Virtual Machine (JVM) Server- Process

13. 3/23/01EMTM 55313 Java Applets Advantages –Platform independent: works for every web-server and browser supporting Java –Secure Disadvantages –Standalone Character: oEntire session runs inside applet oHTML forms are not used –Slow: loading can take a long time –Resource intensive: JVM –Restrictive: can only communicate with server from which applet was loaded Server-Process can be written in any language

14. 3/23/01EMTM 55314 Server-side technologies CGI Active Server Pages, Microsoft Server-side JavaScript, Netscape Java Servlets and JSP (Java Server Pages), SunMicro PHP, developed initially by Rasmus Lerdorf, 1994 to track visitors to his online resume.

15. 3/23/01EMTM 55315 Benefits of server-side processing Minimizes network traffic by limiting the need for the browser and server to talk back and forth to each other Quickens loading time since, in the end, only the actual page is downloaded Avoids browser-compatibility problems Can provide the client with data that does not reside at the client Provides improved security measures, since one can code things that cannot be viewed from the browser

16. 3/23/01EMTM 55316 Web Server Software Feature Sets Core Capabilities –Process and respond to Web client requests using the HTTP protocol Security –Validation of username and password –Processing certificates and key pairs FTP –Transferring of files to or from the server Searching –Searches the existing site or entire Web for documents –Indexing provides full-text indexes for files stored on the server Data Analysis –Capture visitor information oWho, how long, date & time, what pages were visited.

17. 3/23/01EMTM 55317 The Common Gateway Interface (CGI) CGI defines an interface between a Web server and an independent application program. CGI are used to create “gateways” between the Web and an existing application. CGI also serve as the interface for new applications designed for the Web, not integrated directly into a Web server (as in plug-ins).

18. 3/23/01EMTM 55318 CGI (Common Gateway Interface) Runtime Environment Environment Vars Program CGI Web Server Runtime Environment Environment Vars Program

19. 3/23/01EMTM 55319 Server API for CGI Starting and stopping application Passing data from the client to the application Passing data from the application to the client Status and error reporting Passing configuration information to the application Passing client and environment information to the application

20. 3/23/01EMTM 55320 CGI Example Favorite Pet! Favorite Pet What is your favorite pet? Name: Email: Favorite Pet:

21. 3/23/01EMTM 55321 CGI Example (GET) #!/usr/bin/perl -w use CGI qw(:standard); print "Content-type: text/html", "\n\n"; @pairs = split('&', $ENV{'QUERY_STRING'}); foreach $pair (@pairs) { ($name, $value) = split('=', $pair); $value =~ tr/+/ /; $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/ pack("C". hex($1))/eg; $info{$name} = $value; } print " ","\n"; print " Thank you ","\n"; print " Name: ",$info{name}," ","\n"; print " Email: ", $info{email}," ","\n"; print " Favorite Pet: ",$info{pet}," ","\n"; print " ";

22. 3/23/01EMTM 55322 CGI Example (POST) #!/usr/bin/perl -w use CGI qw(:standard); print "Content-type: text/html", "\n\n"; read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'}); @pairs = split('&', $buffer); foreach $pair (@pairs) { ($name, $value) = split('=', $pair); $value =~ tr/+/ /; $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/ pack("C". hex($1))/eg; $info{$name} = $value; } print " ","\n"; print " Thank you ","\n"; print " Name: ",$info{name}," ","\n"; print " Email: ",$info{email}," ","\n"; print " Favorite Pet: ",$info{pet}," ","\n"; print " ";

23. 3/23/01EMTM 55323 CGI Environment Variables Variable NameValue HTTP_HOSTThe hostname of your server HTTP_USER_AGENTThe browser type of the visitor HTTPS“on” if the script is being called through a secure server QUERY_STRINGThe query string REMOTE_ADDRThe IP address of the visitor REMOTE_HOSTThe hostname of the visitor REMOTE_PORTThe port the visitor is connected to on the web server REQUEST_METHODGET or POST SERVER_NAMEThe server’s domain name SERVER_PORTThe port number the server is listening on SERVER_SOFTWAREThe server software used (e.g. Apache 1.3.12)

24. 3/23/01EMTM 55324 Evaluation of CGI Advantages of CGI –General: the application is completely decoupled from the Web server –Standard: works with every sever and browser –Flexible: any language (C++, Perl, Java, …) can be used Disadvantages of CGI –Inefficient: the application must be launched/forked independently for each request –Stateless: the application exits after a request, there is no place to remember state between Web requests –Security: CGI programmer is responsible for security. No automatic system or language support.

25. 3/23/01EMTM 55325 Server-side Scripting A middle ground between static content kept in the file system and pages of dynamic content created by a complete application Server-side scripting –Embed a language interpreter in the Web server. –Web pages stored in the file system contains scripts that are interpreted on the fly.

26. 3/23/01EMTM 55326 Server Extensions: The Basic Idea File-System Web-Server HTTP-Request HTML-File Web-Server Load File File HTML? HTML I/O, Network, DB Script? Output Server Extension

27. 3/23/01EMTM 55327 API depends on Server vendor: –Apache Foundation Apache Server: Apache API –Microsoft Internet Information Server: ISAPI –Netscape Enterprise Server: NSAPI One can define it’s own server extension, e.g., –Authentication module –Counter module Server Extensions

28. 3/23/01EMTM 55328 Active Server Pages (ASPs) –Available in Microsoft web servers (IIS and Personal Web Server) –Based on VBScript, Jscript –Modular Object Model –Active Server Components –Active Data Objects (ADO) for Database access Active Server Pages File-System Web-Server HTTP-Request HTML-File Load File ASP-File HTML ASP-ScriptOutput I/O, Network, DB Active Server Page Scripting Engine Active Server Components

29. 3/23/01EMTM 55329 ColdFusion File-System Web-Server HTTP-Request HTML-File Web-Server Load File File HTML? HTML CF Script? HTML Cold Fusion Server Extension Cold Fusion Application Server ODBC-DriverNative DB Email Directories COM/CORBA

30. 3/23/01EMTM 55330 PHP How does PHP differ from ASP and CF? Free, open source Many client libraries integrated Runs on any web server supporting CGIs (MS Windows or Unix) Module version for Apache File-System Web-Server HTTP-Request HTML-File Load File PHP-File HTML PHP-ScriptOutput Database APIs, other APIs SNMP, IMAP, POP3, LDAP,... PHP Module Web-Server

31. 3/23/01EMTM 55331 Object Technology Advantages –Encapsulation, polymorphism, heterogeneous languages –Rapid application development –Distributed applications –Flexibility of deployment Technologies –CORBA –COM –Java Beans/RMI

32. 3/23/01EMTM 55332 Enterprise JavaBeans (EJB) Server-side component architecture –Enable and simplify the building of distributed object in Java –Allow rapid application development –Support portability and reusability across vendors, I.e., platform and implementation independent EJB supports CTM (Component Transaction Monitoring) –hybrid of traditional transaction processing and distributed object request broker (ORB) services –TP Monitor is an OS for business systems and manages the entire environment that a business system runs, including transactions, resource management,and fault tolerance. –Distributed objects allow unique objects that have state and identity to be distributed accrossa network so that they can be accesses by other systems.

33. 3/23/01EMTM 55333 Server-side component Architecture EJB server is responsible for –Making a component a distributed object –Managing services such as transactions, persistence, concurrency, security Component Advantage –Divides software into manageable, discrete chunk of logic –Implements well-defined interfaces –Enables reuse oComponents can be pieced together to solve larger problems

34. 3/23/01EMTM 55334 Example Pricing Component –Functions: oBase price oQuantity Discount oBundle Discount oPreferred customer Discount oOverhead costs oEtc. –Note: This pricing engine can be used by different businesses

35. 3/23/01EMTM 55335 Example Cont. Post Office Pricing object Dumb TerminalLegacy System

36. 3/23/01EMTM 55336 Example Cont. Car Quotes Web Site Network Pricing object Client Browser Web Server

37. 3/23/01EMTM 55337 Example Cont. E-tailer Site Web Server Workflow logic Billing Object Fulfillment Object Pricing Object

38. 3/23/01EMTM 55338 N-Tier Architecture Using EJB Presentation Logic Presentation Layer Tier Boundary Database Data Layer Tier Boundary EJB object JDBC Business Logic Layer (Application Server)

39. 3/23/01EMTM 55339 Classes and Interfaces Remote interface –The business methods that a bean present to the outside world to do its work Home interface –The bean’s life cycle methods for creating, removing and finding beans Bean class –Actual implementation of the bean’s business methods Primary key –A pointer into the database.

40. 3/23/01EMTM 55340 Acquiring a Bean Client JNDI Naming Service EJB Server 1: retrieve Home Object Reference 2: Return Home Reference Home Object 3: Create New EJB object 5: Return EJB Object Reference EJB Object 4: Create EJB Object 6: Invoke Business method Enterprise Beans 7: Delegate request to object Home Interface Remote Interface

41. 3/23/01EMTM 55341 Enterprise Bean Objects Session Bean –Represents business logic –1 to 1 relationship to client –Stateless / Stateful –Short-lived Entity Bean –Represents permanent business data –1 to many relationship to client –Stateful / Transactional –Long-lived

42. 3/23/01EMTM 55342 The EJB Contract Allows for the collaboration of SIX different parties –Bean provider oComponent writer, provide reusable business logic –Container provider oSupplier of low-level runtime execution environment –Server provider oSupplier of Application server logic to manage the EJBs oWebSphere (IBM ), WebLogic (BEA), Oracle8i –Application assembler oApplication architect for a specific deployment –Deployer oInstalls Bean components and Application servers –System Administrator oOversees the deployed system

43. 3/23/01EMTM 55343 Other features Search engines –Crawl, index, search Push technologies –Web channels Intelligent agents –Locate sites, identify the best vendor, negotiate terms of buying and selling, etc.

44. 3/23/01EMTM 55344 Q&AQ&A