0

I'm trying to create a simple web app with servlet and jsp and I want to use sessions in order to maintain the user session (in fact I have a login page).

My question is: Is it necessary to control if the session is valid for that user in every servlet since I have more than one servlet which redirects to different jsp pages.

For example:

Login.jsp -> Login.java (servlet) (controls the if the login is valid or not)

If the login is valid, it redirects the user in the Welcome.jsp page. Here the user can do some stuff and than call another servlet class which does sth else. In the last servlet, is it necessary to control if the session is valid or not before showing the corresponding .JSP page?

Improve this question

3 Answers 3

Reset to default
3

Perhaps, it is wise to use a ServletFilter. You can check the login there instead of writing in every servlet.

Yes, you must check in every secured page for the login. What if I skip the login and access a page I'm not allowed to view?

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

1

It sounds like you're trying to reinvent the wheel here. It'd be much easier to implement Spring Security than build your own security architecture.

This will control the pages the user can access as well as the session handling. You don't even need to use Spring in the rest of your architecture as it's so plug and play.

Improve this answer

2 Comments

I was tempted to answer the same, but if he's talking about this, he's probably a newbie. Let him learn the basics :)
indeed I don't know very much about creating webapps! I know about spring, or struts but I want to learn first the basics, also because what I want to do is something very simple and just for school! So I'm not going to complicate my life just for 3 servlets and jsp pages! ...oh by the way, "he" is a "she" :) thanks anyways for the suggestion :)
1

You should go with javax.servlet Filter. Its an interface which

performs filtering tasks on either the request to a resource (a servlet or static content), or on the response from a resource, or both.

Authentication-Blocking requests based on user identity is one of the common functions that can be performed using Filter.

This article should help you to start with.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.