This discussion is archived
12 Replies Latest reply: Mar 14, 2011 2:54 AM by gimbal2 RSS

How to send a file from a servlet to a user to download

699554 Newbie
Currently Being Moderated
Hello, I would like to transfer a file from a servlet to a user then delete the file on the server. I read that streaming the file to the user via the HttpServerResponse.getOutputStream() is the best method because then I can delete the temporary file that I am transferring. However this appears to display the contents of the file. What I would like is to have the file be downloaded to the users hard disk or preferably allow the user to accept or decline the file before it is downloaded to disk. Furthermore the files to be transferred range from txt files to csv to docx etc. What is the best method to do this?

Thanks
  • 1. Re: How to send a file from a servlet to a user to download
    EJP Guru
    Currently Being Moderated
    You need to set the Content-Disposition header. Look it up in the HTTP RFC.
  • 2. Re: How to send a file from a servlet to a user to download
    699554 Newbie
    Currently Being Moderated
    Thanks EJP, that worked. The only problem now is that everything happens on the main page, i.e. a user selects a file, clicks upload, then is prompted with a save dialog box. That is a file is being sent from an htm file to a servlet, the servlet then streams the file back to the user to download. What I would love to have is a new page to appear containing information about the file and a button that will then stream the file to the user.

    Any hint on how I would approach this?
  • 3. Re: How to send a file from a servlet to a user to download
    699554 Newbie
    Currently Being Moderated
    Moreover, if I wanted to achieve the following:

    1. user uploads a file to the server.
    2. server manipulates file
    3. user is directed to a page displaying information about the file and is subsequently streamed the file on this page to download.
    4. file is deleted from server

    Currently I have
    1. user uploads a file to the server. this is done by uploading a file from an html document to the servlet.
    2. servlet manipulates file. this is done inside the same servlet.
    3. user is streamed the file from the servlet.
    4. file is deleted.

    To solve this I thought I could:
    1. file is uploaded from main.html page to servlet1.
    2. servlet1 processes the file and stores it in a temp directory.
    3. servlet1 response is a new html page containing information about the file.
    ??
    Now I want to either have a button on this new html page for user to download file, and the file to be deleted from disk regardless. Or automatically stream the file when the new html page containing information about the file is displayed

    Any ideas? I'm stumped
  • 4. Re: How to send a file from a servlet to a user to download
    gimbal2 Guru
    Currently Being Moderated
    user11105060 wrote:
    Now I want to either have a button on this new html page for user to download file, and the file to be deleted from disk regardless. Or automatically stream the file when the new html page containing information about the file is displayed
    You could keep track of the file in the user's session. Then you have two things:

    - create a servlet that will stream the file to the user (call by clicking the button from the info page), and after it has completed sending the file to the response, remove the file from disk
    - add a session listener that upon session timeout will check if said file still exists; if so delete it
  • 5. Re: How to send a file from a servlet to a user to download
    699554 Newbie
    Currently Being Moderated
    Can't thank you both enough!

    Legends!
  • 6. Re: How to send a file from a servlet to a user to download
    gimbal2 Guru
    Currently Being Moderated
    user11105060 wrote:
    Legends!
    Nah, just an old guy and a monkey boy.
  • 7. Re: How to send a file from a servlet to a user to download
    EJP Guru
    Currently Being Moderated
    But the monkey is an independent operator ... he is an entrepeneur.
  • 8. Re: How to send a file from a servlet to a user to download
    gimbal2 Guru
    Currently Being Moderated
    EJP wrote:
    But the monkey is an independent operator ... he is an entrepeneur.
    Hm, we'll flip a coin for who gets to be who.
  • 9. Re: How to send a file from a servlet to a user to download
    EJP Guru
    Currently Being Moderated
    Nah, the monkey is the one who ends up with the coin.
  • 10. Re: How to send a file from a servlet to a user to download
    gimbal2 Guru
    Currently Being Moderated
    EJP wrote:
    Nah, the monkey is the one who ends up with the coin.
    Very wise. You must be the old guy then :p

    Friday afternoon, gotta love it.
  • 11. Re: How to send a file from a servlet to a user to download
    699554 Newbie
    Currently Being Moderated
    Yet another question lol.

    I am concerned about the security of my web app. Currently I have implemented the design above where a file is deleted after it is streamed to the user, or it is deleted after 30 minutes of the session being inactive. Therefore it leaves a window open for someone to upload multiple files to the server within 30 minutes and not stream the download, resulting in the servers hard drive filling up very quickly.

    Since all the files to be downloaded/deleted are stored in a temporary folder, I thought of tracking the size of this folder and automatically clearing it if it gets above a certain size. However this causes yet another security threat since someone can repeat the previous process to remove the files of other users on the server.

    Any ideas how I can safe guard against this problem?

    Also, I am concerned about temporary files created by the servlet which are not automatically deleted in situations when the server is closed unexpected. Would the best solution to this be simply remove all files from the temp directory before and after the main servlet is created/destroyed?

    Thanks
  • 12. Re: How to send a file from a servlet to a user to download
    gimbal2 Guru
    Currently Being Moderated
    Therefore it leaves a window open for someone to upload multiple files to the server within 30 minutes and not stream the download, resulting in the servers hard drive filling up very quickly.
    So? Is this allowed or not? If not: block it in your code. You are already binding files to the user's session, if he tries to upload a second one without doing something with the first, either block it or ask if the previous one should be deleted before processing the next one.

    I ask you a question though: what do you think is the chance of this happening? It is a malicious act with so little impact and it takes an incredible amount of effort to actually perform it. I would say you shouldn't worry about it.
    I thought of tracking the size of this folder and automatically clearing it if it gets above a certain size.
    You could do that. I would create a background service for that though; for example you could use Quartz to make it a scheduled job. When it is not tied to an action a user triggers through the web, you're safe. I wouldn't clear it though as you'll remove files that have been recently uploaded and will still be used, I would remove files that are of a certain age.
    Also, I am concerned about temporary files created by the servlet which are not automatically deleted in situations when the server is closed unexpected.
    Again, ain't gonna happen. And in the off-chance it does happen SOME TIME, a cleanup job scheduled to run once at server startup (again, quartz is very good for this) can certainly fix it.

Legend

  • Correct Answers - 10 points
  • Helpful Answers - 5 points