# Creating a custom tag library

The steps involved in creating a custom tag library are best illustrated by example. The following example shows you the steps for creating a new tag library called sslCheck. This library uses Secure Socket Layer (SSL) for securing your Web site. SSL allows a secure connection between your Web browser and a Web server, and the sslCheck tag provides a flexible way of using secure connections. The tag can be used in any JSP script, including Java™ and JavaScript™.

The following simple tag implementation checks the protocol used, then redirects the user to the secure page or to an error page, depending on the parameterization of the tag (explained later). This secure connection implementation only works for JSP pages (server-side dynamically running pages), and not for HTML (static) pages.

Two files must be created for the new tag:

- sslCheck.java - the Java implementation of the tag
- sslCheck.tld - the taglib definition for the new tag

# Create sslCheck .java

From the Java perspective:

1. Select YourApp.
2. Select File > New > Class. Type the following in the New Java Class window:
   - Package: com.ibm.entry.security
   - Name: sslCheck
   - Superclass: java.lang.Object
3. Click Finish. The source file will open automatically.
4. Delete the automatic code and replace it with the following code:

       package com.ibm.entry.security;

        import java.io.*;

        import javax.servlet.http.*;

        import javax.servlet.jsp.*;

        import javax.servlet.jsp.tagext.TagSupport;

       public class sslCheck extends TagSupport {

         private String errorpage=null;

         public void setErrorpage(String errorpage) {

            this.errorpage=errorpage;

          }

         public int doStartTag() throws JspException {

            try {

             HttpServletRequest request=(HttpServletRequest)pageContext.getRequest();

              HttpServletResponse response=(HttpServletResponse)pageContext.getResponse();

              if(request.getScheme().indexOf("https")==-1) {

                if(errorpage!=null) {

                  // redirect to the error page

                  response.sendRedirect(errorpage);

                } else {

                  // redirect to the page using ssl

                  String jumpURL="https://"+request.getServerName()+request.getRequestURI();

                  if(request.getQueryString()!=null) jumpURL+="?"+request.getQueryString();

                  response.sendRedirect(jumpURL);

                }

                return SKIP_PAGE;

              }

            } catch (IOException ioe) {

              throw new JspTagException("sslcheck tag failed");

            }

           return EVAL_BODY_INCLUDE;

          }

         public int doEndTag() {

            return EVAL_PAGE;

          }

        }

5. Save and close the file.

# Create sslCheck.tld

The tag must be defined in a TLD file. To create the TLD file from the Web perspective:

1. Select YourApp.
2. Select the Web module WEB-INF.
3. Right-click the WEB-INF/tlds folder.
4. Select New > File.
5. Name the file `sslCheck.tld`.
6. Click Finish. The source file will open automatically. Delete the automatic code and replace it with the following code:

       <?xml version="1.0" encoding="UTF-8"?>

         <taglib>

           <tlibversion>1.0</tlibversion>

           <shortname>sslchk</shortname>

           <info>Tag library for checking SSL</info>

           <tag>

             <name>sslcheck</name>

             <tagclass>com.ibm.entry.security.sslCheck</tagclass>

             <bodycontent>empty</bodycontent>

             <attribute>

               <name>errorpage</name>

               <required>false</required>

               <rtexprvalue>true</rtexprvalue>

             </attribute>

           </tag>

         </taglib>

7. Save and close the file.

# Using the tag

Before the sslcheck tag can be used, the following taglib reference must be made.

1. Place the following taglib definition on the first line of the JSP source file:

       <%@ taglib uri="/WEB-INF/tlds/sslCheck.tld" prefix="sslchk" %>

2. Immediately after the taglib definition, place one of the following SSL checking tag in the code. You can use the tag with or without the `errorpage` attribute.

   Option | Description
   --- | ---
   `<sslchk:sslcheck errorpage="error_page"/>` | When the request goes to the JSP and it is not using SSL, the page defined with the `errorpage` attribute will be displayed. You must create the error page with the error messages before you start using the application.
   `<sslchk:sslcheck/>` | Using the tag without the errorpage attribute will redirect the page immediately to the same location but using a secure connection.

3. Save and close the file.

# Set up the SSL transport

If you are deploying to a WebSphere® V5 or V5.1 server, you need to set up the SSL transport for the test application server before you can test the SSL connection in the development environment. To set up the SSL transport, complete the following steps:

1. From the from the J2EE perspective, open the test server configuration (WebSphere Administrative Domain) for the document distribution application.
2. Click the Ports tab.
3. Click on Add next to the HTTP transport list. Supply the following values:
   - Host name: `*` (asterisk)
   - Port: `443`
4. Check the Enable SSL check box.
5. Check the External check box.
6. Click OK.
7. Save and close the file.

SSL transport is now set for the test application server and you can test SSL connection in the development environment. The embedded HTTP server is using a dummy SSL server certificate for the test server. If you want to change the certificate, use the iKeyman utility. The dummy SSL server certificate is located in the following location:

    <install directory>\eclipse\plugins\org.eclipse.jst.websphere.runtime\etc\DummyServerKeyFile.jks

`WebAS` is the password for the JKS file.

# Test the tag

1. Open the file login/login.jsp and click the Source tab.
2. Place the following lines at the top of the file:

       <%@ taglib uri="/WEB-INF/tlds/sslCheck.tld" prefix="sslchk" %>

       <sslchk:sslcheck/>

3. Save the file.
4. Start the application, and then log in.

The browser will notify you that the site is accessed using a secure connection. If the application is using frames, and one or more of the frames is using secure connection, the location in the browser will remain "http" and will not change to "https" .

(C) Copyright IBM Corporation 2000, 2005. All Rights Reserved.