BackendBench
Coffee

Unravel › Java concepts › I/O and files

I/O and data

SFTP and file transfer clients

Many partners still exchange files over SFTP or FTP.

🔎 Unravel this examplePrerequisites (1)

Learn these first

try-with-resources

At a glance

Mental model

A shared loading dock.

What happens, in order
  1. 1Open a session with host, port and credentials (a private key is better than a password), then an SFTP channel: channel.get(remote, local) downloads, put uploads, ls lists
  2. 2Spring Integration and Camel provide pollers that watch a remote directory and turn each new file into a message
  3. 3The robust pattern: poll, download to a temporary name, process, and then move or delete the remote file; or let the sender upload to a temporary name and rename when finished
  4. 4FTP (without S) sends passwords in clear text; use SFTP (SSH) or FTPS (TLS) only
Remember
Watch out
Disabled host key verificationProcessing half-uploaded filesSessions never disconnectedPlain FTP over the internet
Example (highlighted lines explain it)
JSch jsch = new JSch();jsch.addIdentity(privateKeyPath);jsch.setKnownHosts(knownHostsPath);com.jcraft.jsch.Session ssh = jsch.getSession("batch", "files.partner.com", 22);ssh.connect(10_000);ChannelSftp sftp = (ChannelSftp) ssh.openChannel("sftp");sftp.connect();try {    sftp.get("/outbox/orders.csv", localPath.toString());} finally {    sftp.disconnect();    ssh.disconnect();}
  1. line 1 uses JSch, the core of SFTP and file transfer clients
  2. line 6 uses ChannelSftp, the core of SFTP and file transfer clients
Read the full explanation (about 1 min)

Many partners still exchange files over SFTP or FTP. The code connects, lists and downloads or uploads files, and has to handle partial files, retries, and host key verification carefully.

A mental model

A shared loading dock. Partners leave pallets on the dock; you check that a pallet is fully unloaded before taking it, and never accept deliveries from a truck you did not verify.

How it works

Open a session with host, port and credentials (a private key is better than a password), then an SFTP channel: channel.get(remote, local) downloads, put uploads, ls lists.

Spring Integration and Camel provide pollers that watch a remote directory and turn each new file into a message.

The robust pattern: poll, download to a temporary name, process, and then move or delete the remote file; or let the sender upload to a temporary name and rename when finished.

FTP (without S) sends passwords in clear text; use SFTP (SSH) or FTPS (TLS) only.

Going deeper

Verify the host key. Disabling checks (StrictHostKeyChecking=no, PromiscuousVerifier) makes man-in-the-middle attacks trivial; pin the known host key in configuration.

A file visible in the directory may still be uploading. Use an atomic rename convention, a done marker file, or wait until the size stops changing.

Always disconnect in a finally block; leaked sessions exhaust the partner server connection limit and get you blocked.

Under the hood

SFTP is a sub-protocol of SSH. The SSH layer negotiates keys and encrypts the stream; the SFTP layer sends request packets (open, read, write, rename) over one channel and receives responses, so many small file operations are limited by round-trip latency, not by bandwidth.

Common mistakes

  • Disabled host key verification.
  • Processing half-uploaded files.
  • Sessions never disconnected.
  • Plain FTP over the internet.

How Unravel recognises it

When you paste code, Unravel looks for these signs of sftp and file transfer clients. Spotting them yourself is a good habit when you read unfamiliar code:

Part of a learning path

Related concepts

Spring Integration (channels and flows)SpringApache Camel integration routesSpring

Frequently asked questions

What is SFTP and file transfer clients?

Many partners still exchange files over SFTP or FTP. The code connects, lists and downloads or uploads files, and has to handle partial files, retries, and host key verification carefully.

What are the most common mistakes with SFTP and file transfer clients?

Disabled host key verification. Processing half-uploaded files. Sessions never disconnected. Plain FTP over the internet.

How can I see SFTP and file transfer clients in real code?

Paste your own Java into Unravel and it will point out where sftp and file transfer clients appears, explain how it works at the detail level you choose, and draw the flow of the code around it.