Apache Wicket Documentation

repository·master·Indexed 21 days ago

https://github.com/apache/wicket

A component-oriented web application framework. This documentation covers getting started with Maven archetypes, core module dependencies, building from source, and requirements for Wicket 10 (Java 17+ and Jakarta Servlet 5+). It includes technical guidance on implementing encapsulated input components with RegistrationInputPanel, custom authorization logic via IAuthorizationStrategy, and extending component functionality using Behaviors.

Tokens
117.6K
Snippets
318
Records
456
Agent score
73%

What's inside Apache Wicket

  1. Protect applications against CSRF and configure security policies

    master

    Wicket provides several mechanisms to secure your application against common web vulnerabilities:

    • CSRF Protection: Use URL encryption and the ResourceIsolationRequestCycleListener to prevent Cross-Site Request Forgery attacks. (Note: CsrfPreventionRequestCycleListener is deprecated).
    • Content Security Policy (CSP): Wicket includes support for CSP; you can tune these policies to control which resources your application is allowed to load.
    • Cross-Origin Isolation: You can configure Cross-Origin Opener Policy (COOP) and Cross-Origin Embedder Policy (COEP) to achieve cross-origin isolation.
    • Package Resource Protection: Use a guard entity to control which package resources are accessible to users.
  2. Manage static and dynamic resources in Apache Wicket

    master

    Apache Wicket provides mechanisms to handle both static resources (e.g., CSS, JavaScript, images, PDFs) and dynamic resources (generated on the fly).

    Users can:

    1. Manage static resources from code: Use Wicket's resource management techniques to "pack" static files directly with custom components.
    2. Implement custom resources: Create dynamic resources to provide complex, on-the-fly functionality to the web application.
    3. Serve resources as URLs or downloads: Resources can be exposed via simple URLs or provided as direct downloads to the user.
  3. Explore Wicket link components and URL customization

    master
    While the basic Link component functions similarly to a click event handler for navigating between pages, Wicket provides specialized link components for more complex navigation tasks. Additionally, the framework allows you to customize generated page URLs using its encoding facility and pass page parameters to target pages.
  4. What is Component Queueing in Wicket

    master

    Component Queueing is a feature introduced in Wicket 7 designed to automate the construction of the component hierarchy.

    Traditionally, developers must explicitly add every component and container in Java code to match the markup hierarchy. This process is repetitive and requires manual updates whenever the markup structure changes. Component Queueing solves this by allowing Wicket to build the component hierarchy automatically, resulting in simpler and more maintainable Java code.

  5. What is a Wicket Model and how does IModel work?

    master

    In Wicket, a Model is a facade (implementing the org.apache.wicket.model.IModel interface) that decouples components from the underlying data management or persistence strategy.

    Key Characteristics

    • Decoupling: Components interact with the model rather than the concrete data object, allowing the data to be managed or persisted independently.
    • Indirection: Models provide a layer of indirection that allows data to be accessed only when needed (e.g., during the rendering phase).
    • Lifecycle: Wicket triggers onModelChanged() after a model is modified and onModelChanging() just before a change occurs.
    • Sharing: A single model instance can be shared among multiple components, but a component can have at most one related model.

    Core API

    The IModel interface relies on two primary methods for data access:

    • getObject(): Retrieves the data object.
    • setObject(T object): Sets the data object.

    Note that org.apache.wicket.model.Model is a basic implementation of IModel that can wrap any java.io.Serializable object, as models are typically stored in the web session.

  6. Apply HTTPS requirements to multiple pages via inheritance or interfaces

    master

    Instead of annotating every individual page with @RequireHttps, you can apply the annotation to a marker interface or a base class. Any page that extends the base class or implements the marker interface will automatically inherit the requirement to be served over HTTPS.

    // Option 1: Using a Marker Interface
    @RequireHttps
    public interface IMarker {
    }
    
    public class HttpsPage extends WebPage implements IMarker {
        // This page is now secure
    }
    
    // Option 2: Using a Base Class
    @RequireHttps
    public class BaseClass extends WebPage {
        // Base page code...
    }
    
    public class HttpsPage extends BaseClass {
        // This page is now secure
    }
  7. Avoid using instance variables in StatelessLink.onClick()

    master

    When using StatelessLink on a stateless page, Wicket generates a new instance of the page every time the link is clicked. Consequently, any state stored in instance variables of the page will be lost between clicks.

    Warning: Do not rely on instance variables inside the onClick() method of a StatelessLink, as they will reset to their default values upon every interaction. Instead, retrieve necessary data from PageParameters or other stateless mechanisms.

    public class StatelessPage extends WebPage {
        private int index = 0; // This state will be lost on every click
    
        public StatelessPage(PageParameters parameters) {
            super(parameters);
        }
    
        @Override
        protected void onInitialize() {
            super.onInitialize();
            setStatelessHint(true);
    
            add(new StatelessLink("statelessLink") {
                @Override
                public void onClick() {
                    // This will always print the initial value (e.g., 0)
                    // because a new page instance is created for the request.
                    System.out.println(index++);
                }
            });
        }
    }
  8. How to manage state and data lifecycle in Wicket

    master

    Wicket uses a typed session model rather than a generic map structure (like the standard Servlet session). To maintain a clean and efficient application, follow these state management principles:

    1. Use the Wicket Session for Global Data: Store information that is required across nearly every page, such as authentication status, user information, or authorization logic (e.g., determining if a user has permission to edit a specific resource).
    2. Avoid Session Bloat for Flow-Specific Data: Do not store data related to specific forms or multi-step flows in the session if that data only spans a few pages.
    3. Pass Data via Constructors: For data that moves through a sequence of pages, pass the data (or its IModel) directly through the page constructors.
    4. Leverage Automatic Cleanup: Because Wicket pages are user-specific instances, storing models in page fields ensures that data is automatically cleaned up when the user completes or exits the page flow. This prevents the need for manual session cleanup and acts as an 'automatic garbage collector' for your application state.
    public class MyPage extends WebPage {
        IModel<MyData> myDataModel;
    
        public MyPage(IModel<MyData> myDataModel) {
            this.myDataModel = myDataModel;
            Link<Void> next = new Link<Void>("next") {
                 public void onClick() {
                      // do something
                      setResponsePage(new NextPage(myDataModel));
                 }
            };
            add(next);
        }
    }
  9. Accessing raw web entities in Wicket

    master

    While Wicket provides object-oriented abstractions for web development, you may occasionally need to interact directly with low-level web entities like the user session, web requests, or query parameters.

    Wicket provides wrapper classes that allow you to access these entities easily without using the low-level Java Servlet Specification APIs directly. However, you can always access the underlying standard Servlet classes (such as HttpSession, HttpServletRequest, etc.) if required for specific use cases, such as storing arbitrary parameters in the user session.

  10. Understand Markup Inheritance in Wicket

    master

    Wicket supports markup inheritance, allowing a subclassed WebPage to inherit the HTML markup of its parent class. This is useful for maintaining a consistent site layout without duplicating HTML code across every page.

    If you create a class OrderCheckOutPage that extends GenericSitePage, and you do not provide a specific HTML file for OrderCheckOutPage, Wicket will automatically use GenericSitePage.html as the markup for the child page.

    Warning: If no markup is found directly assigned to the class and no markup is inherited from an ancestor, Wicket will throw a MarkupNotFoundException.