/
CampusFind Architecture and Workflows
Save to my account
Sign up
CampusFind Architecture and Workflows
CampusFind Architecture and Workflows
Study
1
Question
How does a CampusFind request travel from the browser to stored data and back?
Page 5
Answer
The browser sends an HTTP request to Tomcat, which runs the applicable filter and servlet. The servlet validates input and uses a DAO or service; a JSP generates the response HTML, which Tomcat returns to the browser. The takeaway is that each layer has a distinct role in the request cycle.
2
Question
Why does CampusFind keep SQL inside DAO classes rather than servlets?
Page 3
Answer
DAOs separate data-access SQL from web logic. If the database changes, the DAO can change while the servlets remain the same. The takeaway is that separating responsibilities makes the code easier to maintain.
3
Question
How does the matching engine decide whether two item reports are a match?
Page 8
Answer
It scores category, location, date, and keywords for a total of up to 100 points. A pair scoring 50 or more is saved as a match. The takeaway is that several explainable rules combine to determine a match.
4
Question
Why must an administrator approve a submitted report before it becomes public?
Page 8
Answer
Anyone can submit report content, so every report begins as PENDING. An administrator checks it before approval, helping keep fake reports out and supporting return of items to their real owners. The takeaway is that review gates public visibility.
5
Question
How do login sessions let the server recognize a user on later requests?
Page 5
Answer
After successful login, the application creates a new session and stores the user object and identifying details in it. The browser retains a JSESSIONID cookie, which lets the server associate later requests with that session. The takeaway is that the cookie identifies the session, not the user by itself.
6
Question
How do CampusFind's Model, View, and Controller roles differ?
Page 5
Answer
The Model represents data, the View presents what users see through JSP pages, and the Controller decides what happens through servlets. The takeaway is that MVC separates data, presentation, and request handling.
7
Question
How does a redirect differ from a forward after form submission?
Page 6
Answer
A forward passes the same request inside the server to a JSP, so the browser URL does not change. A redirect tells the browser to make a new request, changing the URL and helping prevent duplicate form submissions on refresh. The takeaway is that redirects start a browser-side request cycle.
8
Question
Why does successful login destroy the old session before creating another?
Page 6
Answer
The old session is destroyed and a new one is created to prevent session fixation. This prevents an attacker from planting a known session identifier before the victim logs in. The takeaway is to regenerate the session at authentication.
9
Question
How do the authentication and administrator filters enforce different access boundaries?
Page 5
Answer
AuthFilter redirects users without a logged-in session away from protected user pages and sends no-cache headers. AdminFilter allows only users with the ADMIN role to access paths under /admin/. The takeaway is that authentication and role authorization guard different boundaries.
10
Question
Why does CampusFind use the same login error for an unknown email and wrong password?
Page 5
Answer
The error message is identical in both cases, so an attacker cannot learn whether an email belongs to an account. The takeaway is that uniform login errors reduce information exposed during authentication.
11
Question
How do BCrypt and PreparedStatements address different security risks?
Page 3
Answer
BCrypt hashes passwords before they are saved, protecting them from being read as plain text if the database leaks. PreparedStatements use placeholders so user text is not glued into SQL, helping stop SQL injection. The takeaway is that these controls protect credentials and queries respectively.
12
Question
What would happen if CampusFind ran on Tomcat 9 instead of Tomcat 10?
Page 3
Answer
The project uses the Jakarta EE namespace, including jakarta.servlet. Tomcat 9 understands the older javax.servlet names, so the application would not start. The takeaway is that the container version must support the application's namespace.
13
Question
How does Maven turn CampusFind's project files into a deployable application?
Page 2
Answer
Maven reads pom.xml for dependencies and plugins, downloads libraries automatically, and packages the project. Running mvn clean package compiles the Java files and creates CampusFind.war. The takeaway is that Maven manages dependencies and builds the deployment archive.
14
Question
Why are the Servlet API and JSP API marked as provided dependencies?
Page 2
Answer
Tomcat already contains the Servlet API and JSP API, so they are marked provided rather than packaged into the WAR. Other dependencies named in the guide, such as JSTL, the MySQL driver, and jBCrypt, are packaged inside it. The takeaway is that the container supplies the provided APIs.
15
Question
How does Tomcat make CampusFind available after deployment?
Page 2
Answer
Tomcat finds CampusFind.war in its webapps folder and unpacks it. The resulting folder name becomes the application path, /CampusFind. The takeaway is that deployment location and archive name determine the application address.
16
Question
Why does a JSP page load slightly more slowly the first time it is requested?
Page 2
Answer
JSP pages are compiled into servlets when they are first requested. That initial compilation adds work to the first load. The takeaway is that the first request triggers JSP compilation.
17
Question
How do InnoDB and cascading deletion affect related database records?
Page 3
Answer
The database uses InnoDB so foreign keys work. With ON DELETE CASCADE, deleting a user or item automatically removes related rows. The takeaway is that foreign-key relationships can enforce dependent cleanup.
18
Question
How do CampusFind's five tables represent its principal records?
Page 3
Answer
The tables are users, items, claims, notifications, and matches. They store accounts, lost or found reports, ownership claims, in-app alerts, and suggested lost-to-found pairs respectively. The takeaway is that each table represents a distinct record type.
19
Question
How are users, items, claims, notifications, and matches related?
Page 3
Answer
A user can have many items, claims, and notifications. An item can have many claims, while each match links one lost item with one found item. The takeaway is that these relationships model account activity and candidate item pairs.
20
Question
How do PreparedStatement placeholders reduce the risk of SQL injection?
Page 3
Answer
Each query uses a PreparedStatement with ? placeholders. User text is not glued into the SQL, which stops SQL injection. The takeaway is to keep user-supplied values separate from query structure.
21
Question
Why does try-with-resources matter when database connections are used?
Page 3
Answer
try-with-resources closes connections automatically. This prevents connections from being left open and leaking. The takeaway is that automatic resource closure supports reliable database access.
22
Question
How do a model class and a DAO class differ in this architecture?
Page 3
Answer
A model class is a plain Java object representing one table row. A DAO class holds SQL, with an interface and implementation separating data access from servlet logic. The takeaway is that models represent data while DAOs retrieve or store it.
23
Question
How does the registration process validate and store a student account?
Page 5
Answer
RegisterServlet checks the email format, student ID, name, and password length. It hashes the password with BCrypt at work factor 10 and saves a STUDENT account. The takeaway is that validation and password hashing precede account storage.
24
Question
What happens to a deactivated account during a login attempt?
Page 5
Answer
LoginServlet refuses a deactivated account. On successful login, the application instead creates a new session and redirects users according to their role. The takeaway is that account status is checked before an authenticated session is granted.
25
Question
How do upload limits and file renaming reduce risks from submitted photos?
Page 6
Answer
FileUploadUtil accepts JPEG, PNG, and WEBP files up to 5 MB, renames each file to a random UUID, and saves it in images/uploads/. The renaming avoids clashes and dangerous file names; the checks reject unsupported or oversized files. The takeaway is to constrain and safely name uploads.
26
Question
Why does a newly submitted lost or found report remain hidden?
Page 6
Answer
ItemDAO saves the report with PENDING status and the student receives an in-app notification that it awaits administrator review. The report remains hidden from the public until an administrator approves it. The takeaway is that submission does not equal publication.
27
Question
How can a student search and filter approved CampusFind items?
Page 6
Answer
ItemListServlet displays approved items and searches keywords across name, description, and location using SQL LIKE. It also filters by type and category. The takeaway is that keyword search and categorical filters provide complementary ways to narrow results.
28
Question
How does HTML escaping protect item descriptions from cross-site scripting?
Page 6
Answer
ValidationUtil.sanitize performs HTML escaping. This protects against a user entering script tags into a description and having them treated as executable content. The takeaway is to escape user-supplied text before it is rendered as HTML.
29
Question
How does the matching engine score a pair with identical category, location, and date?
Page 8
Answer
The identical category contributes 30 points, identical location contributes 30, and the same date contributes 20. These criteria total 80 points before keyword points are added, exceeding the 50-point match threshold. The takeaway is that strong agreement across core fields can qualify a pair even before keyword scoring.
30
Question
How does the matching engine score location text that partially overlaps?
Page 8
Answer
Identical location text scores 30 points. If one location contains the other, it scores 20; if they share a meaningful word, it scores 15; otherwise it scores 0. The takeaway is that progressively weaker textual overlap receives fewer points.