strange experience with trying to invalidate a session

[Amit Batra]

I have a JSP that collects a username and pass and sends to a Loginservlet and changes its look depending on if its a sigin in or log out. below is the code.

<%@ page import="business.*;"%>
<%! User user=null;%>
<%   
        String loggedStatus= (String)session.getAttribute("loggedIn");
        if(loggedStatus=="true"){
        out.println("Welcome back user"); 
        user = (User)session.getAttribute("user");
        }
 %>
 
//<% if (user == null) { %>  <- didnt work. didnt show sign in fields
//<% if(loggedStatus!=true)% > <- DID work. did show the siging in fields.
         <FORM ACTION="LoginServlet" METHOD=GET>
    Email Id:           
  <INPUT TYPE=TEXT SIZE=12 NAME=emailId>
<br>
Password: <INPUT TYPE=text SIZE=12 NAME=password>
<br>
 <INPUT TYPE=SUBMIT VALUE="Signin" ALIGN=CENTER>
</FORM>

<% } else { %>
Logged in as <%=user.getFirstName()%>

<a href="Logout">Log out</a>
<% } %>

 

the servlet adds a 'loggedIn' variable and a user object variable onto the session. below is the code:

 
 session.setAttribute("loggedIn","true");
 session.setAttribute("user", user);

.


When the user clicks the logout , the logout servlet deletes the attributes and invalidates the session. code below

 HttpSession session = request.getSession(false);
session.removeAttribute("user");
session.removeAttribute("loggedIn");
session.invalidate();

the oddity is that the servlet didint remove the user object attribute from the session but it did the loggedIn string when I logged out.

[Bear Bibeault]

Before you do anything else, remove this logic from a JSP and put it into a servlet or filter where it belongs.

And the following:

<%! User user=null;%>

is a huge problem. This makes your JSP non-thread-safe as every concurrent request made to your JSP will share the same user variable.

Avoid these pitfalls by only using JSPs for the purpose they are intended for: renderrring the display. Perform all processing and decision making outside of JSPs.

[Amit Batra]

I think you're absolutely right Bear. The code ran fine the first couple of time I tried it, but it bombed soon enough and got me back to square one. Thanks alot for the tip.