Basic Session Validation

[Dave Wingate]

I'm new to JSP and am trying to get my first project up an running. I thought I'd start with two basic pages: login.jsp and index.jsp. I wanted to write a scriptlet for the head of index.jsp that would redirect to login if the user was not already logged in. I wrote the following code:

 
// try to get session, if session doesn't exist, check request
String sessionUserName = (String)session.getAttribute("UID");
// do this only if a valid session does NOT already exist
if ( sessionUserName == null || sessionUserName.equals("") ) {

// get the request version of UID and password
String requestUserName = request.getParameter("UID") ;
String requestPassword = request.getParameter("password") ;

// if UID or passwd blank, redirect
if ( requestUserName == null || requestUserName.equals("") 
     || requestPassword == null || requestPassword.equals("") 
   ) {
response.sendRedirect( response.encodeRedirectURL( "login.jsp" ) ) ;
} // if (nulls or blanks)
// Otherwise, set the session variables and continue
else {
session.setAttribute( "UID", requestUserName );
session.setAttribute( "password", requestPassword );
} // else (set session)

} // if(session not already verified)
 

This works just fine for the purpose of redirecting the user . After the above scriptlet, I can print the session suerID and password on the index.jsp page without a problem:
Your user name is: <%= session.getAttribute("UID") %> <br>
Your password is: <%= session.getAttribute("password") %>
The problem is that as soon as I leave the index.jsp page, the next page doesn't find session values for UID or password. Is there something I have to do to get these session variables to persist across multiple jsps? I thought that the calls to session.setAttribute() wuld be enough?

[Amit Delve]

I think your session.setattribute() method is not getting called. it is in the "else" clause - if the redirection is taken place in the "if" clause, the "else" would never be called and your session variables will never be set.
I hope i have understood what you are trying to do here.
- Amit.

[Dave Wingate]

Thanks for the comments. I think that setAttribute() is getting called. On the same page, but below the scriptlet in question, I have the JSP print out the session attributes and they are populated with the request values.
I don't think that the calls to setAttribute() being inside the else caluse is the problem here. The logic of the scriptlet is basicly:

 
if (session variables NOT populated) {
if (request variables NOT populated) {
redirect
}
else {
set session variables to request variables
}
} 
 

I'm redirecting because I don't want the user to get to this page unless he is supplying a user id and password (as part of the request from the login page).
Thanks, and please let me know if you see anything else that strikes you as odd.

[jhong jaewon]

Some Other Tip.

if ( sessionUserName == null || sessionUserName.equals("") ) {
==> I Think. that is not Good.

if ( sessionUserName == null || sessionUserName.length() < 0 ) {
OR
if ( sessionUserName == null || "".equals(sessionUserName) ) {
==> When String compare. if compared String is null is cause NullPointer Exception.