How to secure session variable in HttpSession using java servlets

Question

I think there should a way to set session variable with defined scope in pure java Servlet without using other library like jsf or springframework so that visibility of session variable can be restricted.

public void doGet(HttpServletRequest request, HttpServletResponse response) {
    HttpSession session = request.getSession();
    String userId = (String)request.getAttribute("userId");
    session.setAttribute("userId", userId);
}

I found ServletContext

ServletContext context = request.getSession().getServletContext();
context.setAttribute("userId", userId);

but this one doesnot seem to provide session scope flexibility.

What do you mean "restricted", and why put it in the Session in the first place? — Elliott Frisch
– Elliott Frisch, Commented May 17, 2014 at 4:10
I am actually developing liferay portlets and i am also using delegate servlet which is HttpServlet. There is function to limit scope of session variable in PortletSession but i don't find such methods to limit session variable in HttpSession.I am curious. — gyanu
– gyanu, Commented May 17, 2014 at 4:16

user207421 · Accepted Answer · 2014-05-17 04:24:30Z

1

You've found it. Set a session attribute. The scope of a session attribute is the scope of a session, which is a single user.

The portlet scope just controls whether the attribute is confined to the current portlet or is visible to all portlets. It's still within the user session. If you need to implement that feature, just bind a Map into the session under the name of the portlet, and have each portlet look in its own Map.

If you set a context attribute it will be visible to all users.

answered May 17, 2014 at 4:24

user207421

312k45 gold badges324 silver badges493 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

gyanu Over a year ago

can you provide some examples or links. I would like to understand how session scope works.

user207421 Over a year ago

It's irrelevant how it works. It belongs to a specific user. That's all you need to know. It's guaranteed by the Servlet Specification #7.

gyanu Over a year ago

currently i am not able to uniformly share session variable from servlet.Some session variables simply just persist in hook and other portlets. Some session variable requires use of LIFERAY_SHARED_ prefix to share with some portlets.

user207421 Over a year ago

What exactly does 'unable' mean?

gyanu Over a year ago

i don't understand bind a map into the session under the name of the portlet request.getSession().setAttribute("nameofPortlet",someMap);

|

Collectives™ on Stack Overflow

How to secure session variable in HttpSession using java servlets

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related