I thought this was interesting, although the actual security impact is hard to assess. Various sites "leak" information not through the payload returned by a particular HTTP request, but simply by the response code. Thus, as this article illustrates, we can find out, for example, whether a user is logged on to sites like Facebook as follows:

- find a particular page that responds with an error code or not depending on whether or not the user is logged on;
- using a "script" tag, ask the browser to load that page as though it were a script;
- in the onload() and onerror() handlers, take action that assumes the user is logged on in the first place and not in the second.

The fact that a user is logged into, say, Facebook or GMail probably isn't a very exciting discovery: half the Internet population probably are at any given moment. But more controversial sites may want to think about what kind of information they accidentally leak in this way.

Section on Java Servlets

The newly updated section on writing Java Servlets, looks at issues such as the following:

• some of the "mechanics" of getting start with Servlets, such as getting the appropriate version of the JDK and some Servlet hosting tips such as the features and quotas that you should be looking out for in a Servlet hosting package
• the anatomy of an example Servlet
• dealing with HTTP sessions, and why you should use the Java Session API to handle them;
• dealing with "raw" cookies when you need them;
• deciding if you need to modify your Servlet to work with keep-alive connections: in some configurations, you may be beneficial to add some code to set the Content-Length header; we discuss how to find out if this is necessary.

Web programmers may also be interested in the section on Java AJAX programming currently in development.

Comments and suggestions for extra material are always welcome, of course!