Steal a session

I use class URL in my servlet A to retrieve the content of another servlet B.
A and B are in the same application context.
Can I pass the session info of A to B so that B will have A�s session?

Thanks.

There's no need to pass the session from one servlet to the next - sessions are application-wide. So if a session has been created for a user in servlet A, then it will be available in servlet B as well.

Thank Ulf.
Note I am using class URL (insider servlet A) to grab the contents of servlet B. B will treat this request (evoked from URL object) as a new browser session.

Maybe I should use RequestDispatcher to include contents of another servlet.

While it's possible to make URL (or rather, HttpURLConnection) work in this case, RequestDispatcher is the much more straightforward and performant way to go.

Thank Ulf:

Could you give a hint as how to make URL (or rather, HttpURLConnection) work in this case?

I tried URL class and could not make it work.

Thanks.

It depends a bit on how sessions are handled in your web app. If you have enabled cookies, then the session ID would be transported in a cookie. In that case you'd grab the cookie from the incoming request, and set its value as the value of a header named "Cookie" in the HttpURLConnection.

Thanks Ulf I will try it.

What is the difference between using URL class and using HttpURLConnection class?

Thanks.

What is the difference between using URL class and using HttpURLConnection class?

Looking at their respective javadocs, they don't look remotely related

URL does use HttpURLConnection under the hood, but it doesn't expose any of its more advanced features, e.g. the ability to set and read headers, or to get at the underlying streams.

Try Apache HttpClient, it has clean API to read cookies from the request and set it again for a new request...

It seems to me that the very first time when the servlet is run there is no cookie in the Request. So either HttpURLConnection or Apache HttpClient will not be able to call another servlet and pass the session info to it. So the first time A and B will have different sessions. In subsequent access however A and B will share the same session (B steals a session from A).

It looks like RequestDispatcher is the way to go.

Well, the first time a servlet is accessed there can't be cookie, because there is no session. Upon seeing that there is no cookie, a session should be created, which can then be passed on.

Thanks Ulf.

You have a point. I will try that. Maybe Apache HttpClient already have that logic.
RequestDispather is working very well.

Hi !