session issue

Hello ranchers,

Offlate i have been experincing a very unqiue issue with application.
My application unable to retreive data from session and hence getting NullPointerException.
This is happening only with InternetExplorer.....But the same works fine with Mozilla firefox ,Google chorme etc..

Is there any session related session which needs to be configured...for InternetExplorer....or some other issue...

Any help will be appreciated.....

Check in your browser settings if cookies are disabled. If so, enable cookies & try once again. You may want to reset the settings in Internet Explorer to 'default' & try running your web-app. If this doesn't work as expected, post your code here so that we can have a look.

hi Nilesh,

Did the changes in Internet explorer as per your reply.But still getting the same issue.

Attaching my code.JSP Page

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<link rel="stylesheet" type="text/css" href="/pg/CSS/reset-fonts-grids.css" media="all" />
<link rel="stylesheet" type="text/css" href="/pg/CSS/default.css" media="all" />

<title>Kotak Net Banking > Access Code</title>
<%@ page language="java" import="java.sql.*,java.io.*,java.util.*,java.beans.*, java.lang.Object"%>
<%@page import=" java.util.*" %>
<%@ page import="ksecurity.common.*, ksecurity.worker.*"%>
<%@ include file="cacheParameter.jsp"%>

<%!
	public String checkString(String comment){		
       int len= comment.length();
	   String val = comment.substring(0,len);
	   for(int i=0;i<len;i++){
	   		if((val.substring(i,i+1)).equals("<") || (val.substring(i,i+1)).equals("{")||  (val.substring(i,i+1)).equals(">") 
                            || (val.substring(i,i+1)).equals("}") || (val.substring(i,i+1)).equals(")") ||  (val.substring(i,i+1)).equals("(")){  			
			return ("E");
			}
		}
		return comment;
		}

System.out.println("in GeneratePin.jsp");

HttpSession appSession = null;
	appSession = request.getSession(false);
	String UserId=(String) appSession.getAttribute("usrId");
	System.out.println("GeneratePin.jsp =  UserId"+UserId);%>
</head>

<body class="body" onload="document.frm_GeneratePin.smspin.focus();">
<form name ="frm_GeneratePin" method="post" autocomplete="off" onKeyDown="getKey()">	
<div id="doc5">
  <div class="main_netPin">
    <div id="logo">
      <div class="logoLt"><img src="/pg/images/logo.gif" width="141" height="44" /></div>
     <div class="logoRt">Welcome to Kotak Payment Gateway  <a href="#" onclick="return backToKS()" class="btn-cancel"> </a></div> 
     
    </div>

<div id="heading">Access Code</div>
	
    <div class="login_content">
	<div class="headingNote">To enhance your security and safety, we have now introduced the Access Code. To log into Net 
            Banking you would need to enter an additional password i.e. your ‘Access Code ’.</div>
      <table width="100%" border="0" cellspacing="0" cellpadding="0">
        <tr>
          <td><div class="loginBox_netPin">
              <table width="100%" border="0" cellspacing="0" cellpadding="0">
				<tr height="9">
                  <td width="34%" align="right" valign="middle" bgcolor="#d3d3d3"></td>
                  <td width="2%" align="right" valign="top" bgcolor="#d3d3d3"></td>
                  <td width="64%" align="left" valign="top" bgcolor="#d3d3d3"></td>
                </tr>
				<tr>
                  <td align="right" valign="middle" bgcolor="#d3d3d3" class="trLogin"><b>Access Code: </b></td>
                  <td align="right" valign="top" bgcolor="#d3d3d3"> </td>
                  <td align="left" valign="top" bgcolor="#d3d3d3" class="trLogin"><input name="smspin" type="Password"  size=25 maxLength=6 class="NetPinTextbox"/></td>
                </tr>
                <tr height="9">
                  <td align="right" valign="middle"></td>
                  <td align="right" valign="top"></td>
                  <td align="left" valign="top"></td>
                </tr>
                  <tr>
                  <td align="right" valign="top"> </td>
                  <td colspan="2" align="left" valign="top"><a href="#" onClick="return button1submit(this.form);">
                    <img src="/pg/images/loginBtn.gif" width="103" height="24" border="0" align="absmiddle" /> </a>  
                    <img align="absmiddle" src="/pg/images/loginCheck.gif"></td>
                </tr>
				
                <tr>
                  <td colspan="3" align="left" valign="top" class="gen_AC"><b>Click here to</b> <a href="#" onclick="return openSmsGen(this.form);">Generate the Access Code</a></td>
                </tr>
              </table>
            </div>
			<div class="arrowNetPin"><img src="/pg/images/arrow_netpin.gif" width="9" height="12" /></div>
            <div class="loginContent_rt">
               <iframe src="/pg/LoginPad.jsp" width="100%" frameborder="0" scrolling="no">
				  <p>Your browser does not support iframes.</p>
			   </iframe>
            </div>
		  </td>
        </tr>
      </table>
	  <h1>What is Access Code?</h1>
	  Access Code is an additional verification required to log in to Net Banking for increased security and safety. This PIN can be generated online and
          will be sent instantly to your preferred Email ID and Mobile Number registered with the Bank. Access Code’s validity is up to 11:59 P.M. (IST) of the
          day it is generated by you.
	  <h1>How to generate Access Code?</h1>
	  An 'Access Code' can be generated by entering your User ID / Nick Name and your Net Banking Password and clicking on Generate an 'Access Code' link above. 
	    <h1>How to deregister for Access Code?</h1>
	  To De-register for Access Code on Net Banking, please click on 'Requests' section post log into Kotak Net Banking.
	  <h1><a href="access_code_FAQs.html" target="_blank" class="underlined">Read more FAQs on Access Code</a></h1>
    </div>
    <div class="footInst">
		<h1>Important:</h1>
		<p>Please ensure your Email ID and Mobile Number are registered with the Bank to receive the Access Code. You can check your preferred Email ID 
                and Mobile Number which you have updated with us, through the ‘Profile’ section available after you log in to Net Banking.</p>
		<p>Incase you wish to update your Email ID and Mobile Number, you need to submit a signed request along with an acceptable proof of identity at your 
                nearest Kotak Mahindra Bank's Branch.</p>
    </div>
  </div>
</div>
<input type="hidden" name="hidRequestId" value="KSPG1000">
<input type="hidden" name="hidOperation" value="MH100">

<div id="copyright">
  <div class="innerCopyright"><p class="left1"><a href="#" target="_blank">Disclaimer</a></p>
  <p class="right">Copyright Kotak Mahindra Bank Limited</p></div>
</div>
</body>
</form>
 <script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-4203568-3");
pageTracker._trackPageview();
} catch(err) {}</script>

<%

String Error =request.getParameter("ErrorMsg");
System.out.println("GeneratePin.jsp Error: "+Error);
String flag =(String)request.getAttribute("ERMSG");
System.out.println("GeneratePin.jsp flag:"+flag);
String flagValue =(String)request.getParameter("flagvalue");
System.out.println("GeneratePin flagValue:"+flagValue);
String Error1 =request.getParameter("ErrorMsg1");
System.out.println("GeneratePin.jsp Error1:"+Error1);

String errchk="";
String flagchk="";
String errchk1chk="";

if(Error!=null){
 errchk=checkString(Error);
}
if(flagValue!=null){
 flagchk=checkString(flagValue);
}
if(Error1!=null){
 errchk1chk=checkString(Error1);
}

System.out.println("GeneratePin.jsp errchk :"+errchk+"flagchk  :"+flagchk+"errchk1chk :"+errchk1chk);

if (errchk.equals("E") || flagchk.equals("E") || errchk1chk.equals("E")){
        System.out.println("GeneratePin.jsp Error while checking for errchk and flagchk and errchk1chk ");
		response.sendRedirect("500Error.jsp");
		}else{
 //private HttpSession mo_HSession = null;
  /* String hidRequestId =  request.getParameter("hidRequestId");
    String  hidOperation = request.getParameter("hidOperation");
	System.out.println("hidRequestId"+hidRequestId);
	System.out.println("hidOperation"+hidOperation);*/
%>
<%if(flag!=null && flag.length()>0 )
{
	//check flag condition 
if( flag.equals("KPY001sms"))
{%>

alert('Please enter correct Access Code.');

</script>

<%}else if(flag.equals("KPY002sms"))
{%>
<script>
//alert('Your Access Code has expired. Please generate a new by clicking on Generate Access Code.');
alert('Your Access Code has expired. Please generate a new by clicking on Generate Access Code.');
window.location.href="/pg/kcheck.jsp"
</script>
<%}
else if(flag.equals("Please enter the Access Code."))
{%>
<script>

alert('Please enter the Access Code.');

</script>
<%}

else if(flag.equals("Please generate Access Code by clicking on Generate Access Code."))
{%>
<script>

alert('Please generate Access Code by clicking on Generate Access Code.');

</script>
<%}

}
%>

<%if(Error1!=null&&Error1.length()>0)
{
	if(flagValue.equals("NA")|| flagValue.equals("NNA"))
	{
	%>
<script>

alert('<%=Error1%>');

window.location.href ="ksecLogin.jsp";

</script>

<%

}else
	{%>
<script>

alert('<%=Error1%>');

</script>
<%}}}%>
<script language="javascript"> 
function getKey(keyStroke) {
	try
	{

var keyCode = (document.layers) ? keyStroke.which : event.keyCode;
   if(keyCode==13)
		{
		if(event.srcElement.name == 'Password')
		button1submit(document.frm_GeneratePin);
		}

}
	catch (error)
	{
	}
}
</script>

function getFlag()
{
	return cField;
}

function check_numval(inputField)
{
	var numval = new Number(inputField.value)
	if (isNaN(numval))
		{
			return false;
		}
	else
		return true;
}

}
function openSmsGen(theelement,form)
{

document.forms['frm_GeneratePin'].action="/pg/GenSMS.jsp";
document.forms['frm_GeneratePin'].method="post";
document.forms['frm_GeneratePin'].submit();
return true;
}

function calcModHeight(fobject){
	
		var fid = fobject.id;
		var bf = document.getElementById(fid);
		var mainFrameHeight = bf.contentWindow.document.body.scrollHeight;
		bf.height = mainFrameHeight;
}

</script>

</html>

Servlet ---

package ksecurity.controller;

//set of import statements

public class  KSRequestHandler extends HttpServlet {

private ResourceBundle mo_Rbundle  = null;
    private ServletContext mo_context = null;
    private KSLog mo_logger    = new KSLog("KSRequestHandlerServlet");
    private String  ls_ReturnPage = null;

public void init(ServletConfig servletconfig) throws ServletException	{
          super.init(servletconfig);
          {
            mo_context = getServletContext();
            try  {
              //mo_Rbundle = ResourceBundle.getBundle("ksecurity.properties.KSRequestMapper");
              mo_Rbundle = ResourceBundle.getBundle("KSRequestMapper");
             mo_logger.debug(" Found A Resource Bundle: KSRequestMapper ");
                 } catch ( Exception ex_init)  {
              mo_logger.fatalerror("Error in initialising Parameter : "+ex_init);
             mo_logger.debug(" Could not Find A Resource Bundle: KSRequestMapper ");
            }

}
      }
  public void doGet ( HttpServletRequest request, HttpServletResponse response ) throws  ServletException,IOException            {
       doPost(request,response);
      }

public void doPost ( HttpServletRequest request, HttpServletResponse response ) throws ServletException,IOException            {
        mo_logger.info(" Processing request  :doPost");
        KSAbstract  lo_KSAbstract = null;
        RequestDispatcher lo_ReqDespatcher = null;
        String            ls_RequestId = null;
        String            ls_User = null;
        HttpSession    lo_session = null;
        boolean lb_pageType = false;
		   String chkReqId=null;
     
        try  {
            lo_session= request.getSession();
            if (lo_session == null) {
             mo_logger.debug(" lo_session is Null ");
             throw new Exception( " Invalid lo_session ");
            }

ls_RequestId = request.getParameter("hidRequestId");
           String op = request.getParameter("hidOperation"); 
           String msg = request.getParameter("msg");

if(op.equals("MH100")){
		  chkReqId= (String)getServletContext().getAttribute("chkIdReq");
			mo_logger.info("chkIdReq from request in doPost when op is MH100: "+chkReqId);
			request.setAttribute("chkIdReq",chkReqId);
		   }
           if (ls_RequestId != null )
           {
			   mo_logger.debug(" ls_RequestId " + ls_RequestId); 
           }
		   if (op != null)
		   {
	           mo_logger.debug(" opcode " + op);
		   }
		   if (msg != null)
		   {
	           mo_logger.debug(" msg " + msg);
		   }
           
          
           if(ls_RequestId == null || ls_RequestId.length()==0)
           {
             mo_logger.info("REQUESTID is null");
             lb_pageType = false;
             request.setAttribute("ERMSG", "KPY024");
             ls_ReturnPage = "ERROR";
           }
           //IF request ID is NOT NULL, check for the page type whether BEAN or JSP
           else if(ls_RequestId != null)
           {
                   mo_logger.debug("REQUEST is set for : "+ls_RequestId);
                   lb_pageType = ls_RequestId.startsWith("KS");
                   if(lb_pageType)
                   {
                     try
                     {
                          ls_ReturnPage = mo_Rbundle.getString(ls_RequestId);
                          mo_logger.debug("REQUEST page is : "+ls_ReturnPage);
                          lo_KSAbstract = (KSAbstract) Class.forName(ls_ReturnPage).newInstance();
                          ls_ReturnPage = lo_KSAbstract.handleRequest(request, response);
                     }
                     catch(Exception e)
                     {
                          mo_logger.fatalerror("Exception in doPost() " + e.toString());      
                          request.setAttribute("ERMSG", "KPY024");
                          ls_ReturnPage = "ERROR";
                     }
                     
                    }
                    else
                    {
                      ls_ReturnPage = ls_RequestId;
                    }
           }
       mo_logger.debug("The Return Pa	ge Key is : "+ls_ReturnPage);
        } 
        catch (Exception exception)                            {
            mo_logger.error(exception);
            request.setAttribute("ERMSG","KPY025");
            ls_ReturnPage = "ERROR";
        }
        finally {
            try
            {
				if (ls_ReturnPage != null)
				{
	                ls_ReturnPage = mo_Rbundle.getString(ls_ReturnPage);
				}
            }

catch(Exception e)
            {
                 mo_logger.fatalerror("Exception in doPost() " + e.toString());      
                 request.setAttribute("ERMSG", "KPY024");
                 ls_ReturnPage = "ERROR";
                 ls_ReturnPage = mo_Rbundle.getString(ls_ReturnPage);
            }
            
            mo_logger.debug("The Return Page is "+ls_ReturnPage);
			if (ls_ReturnPage != null)
			{
				if(lb_pageType)
						   lo_ReqDespatcher =  getServletContext().getRequestDispatcher(ls_ReturnPage);
				else
						  lo_ReqDespatcher =  getServletContext().getRequestDispatcher("/"+ls_ReturnPage);

response.setHeader("Cache-Control","no-cache"); 
				response.setHeader("Pragma","no-cache"); 
				response.setDateHeader ("Expires", 0);  
				lo_ReqDespatcher.forward(request, response);
			}            
        }

}// END OF dopost

}

Class file -----this redirect to jsp page.

package ksecurity.worker;

//set of imports statements

public class KSMsgHandler extends KSAbstract
{

private  static String CLASSINFO = "KSPG1000"; 
    private static KSLog mo_logger = new KSLog("KSMsgHandler");
    private static KSQueryInteractor mo_QInteractor = new KSQueryInteractor();
    private HttpSession mo_HSession = null;
    private HashMap	mo_PageInfo = null;
    private String ms_OpCode = null;
    private String mo_ReturnPage = "ERROR";
    private KSConnection con = new KSConnection();
    private boolean flag =true;
    private String ms_classId = null;
	 String chkReqId=null;
    private ResourceBundle mo_rBundle = ResourceBundle.getBundle("KSRequestMapper");

//Added for cross site script
    public String checkString(String comment){		
       int len= comment.length();
	   String val = comment.substring(0,len);
	   for(int i=0;i<len;i++){
	   		if((val.substring(i,i+1)).equals("<") || (val.substring(i,i+1)).equals("{")||  (val.substring(i,i+1)).equals(">") || (val.substring(i,i+1)).equals("}")
                          || (val.substring(i,i+1)).equals("'") ||  (val.substring(i,i+1)).equals(";") || (val.substring(i,i+1)).equals(":") || (val.substring(i,i+1)).equals(")")
                          ||  (val.substring(i,i+1)).equals("(")){  			
			return ("E");
			}
		}
		return comment;
		}
   //end

public String handleRequest( HttpServletRequest request, HttpServletResponse response ) throws Exception 
  {
      try
      {
          mo_logger.info("inside handleRequest() method of KSMsgHandler");
          ms_classId =  request.getParameter("hidRequestId");
          ms_OpCode = request.getParameter("hidOperation");
          
          mo_HSession = request.getSession(false);
		  	mo_logger.error("sessionId in handleRequest  :" +mo_HSession.getId());
         
		  String valchk1 =(String) mo_HSession.getAttribute("chkId");
		 mo_logger.error("valchk1 from session in handleRequest: " + valchk1);

mo_logger.error("Entering in check loop for operation : "+ms_OpCode);
          if( ms_OpCode.equals("MH100") )
          {
              mo_HSession.setAttribute("methodId","MH100");
			    chkReqId=(String)request.getAttribute("chkIdReq");
				mo_logger.info("chkIdReq from request in handleRequest: "+chkReqId);
              mo_ReturnPage = authUser(request, response);
          }
          else
          {
              mo_logger.info("calling isValidSession");         
              if(!KSUtil.isValidSession( request, response))
              {
                 mo_logger.error("handleRequest: Invalid session");
                 request.setAttribute("ERMSG","NOSES");
                 mo_ReturnPage =  "ERROR";
              }
              else
              {
                      if (ms_OpCode == null || ms_OpCode.length() == 0)
                      {
                          mo_logger.error("The OpCode is null or not valid");
                          request.setAttribute("ERMSG","KPY024");
                          mo_ReturnPage = "ERROR";
                      } 
                      else
                      {
                          mo_logger.debug("The Operation Code is :" + ms_OpCode);
     
                              // Mangesh Please explain 
                              if (ms_OpCode.equals("MH102") && ms_classId.equalsIgnoreCase("KSPG1000") && ( mo_HSession.getAttribute("methodId").equals("MH103")
                                  || mo_HSession.getAttribute("methodId").equals("MH100")  )   ) {
                                mo_HSession.setAttribute("methodId","MH102");
                                mo_ReturnPage = getAccountNumbers(request, response);
                              }
                              else if (ms_OpCode.equals("MH103") && ms_classId.equalsIgnoreCase("KSPG1000") && ( mo_HSession.getAttribute("methodId").equals("MH100")
                                         || mo_HSession.getAttribute("methodId").equals("MH102") ) )    {
                                mo_HSession.setAttribute("methodId","MH103");
                                mo_ReturnPage= showConfirmation(request, response);
                              }
                              else
                              {
                                  request.setAttribute("ERMSG","KPY024"); 
                                  mo_ReturnPage = "ERROR";
                              }

}
              }
      }
    }catch(Exception e)
    {
        mo_logger.fatalerror("Exception in handleRequest() :: KSMsgHandler " + e);
        request.setAttribute("ERMSG","KPY025");
        mo_ReturnPage = "ERROR";
    }finally
    {
        mo_logger.debug("handleRequest: Inside finally returning " + mo_ReturnPage);
        mo_logger.info("Quiting from handleRequest() method of KSMsgHandler");
        return mo_ReturnPage;
    }
  }//end of handleRequest

private String authUser(HttpServletRequest request, HttpServletResponse response)
  {
      String ls_msg = null;
      String lsReturnPage = null;
      boolean verifyMsg = false;
      String userId = null;
		  String smspin = null;
	   String crnalias = null;
      String userPwd = null;
      String ls_sessionTime = null;
      String ls_ldapStatus = null;
      String ls_kmblRedirect = null;
      String ls_merchantId = null;
	  
	  String ls_clientId = null;
      StringTokenizer lo_st= null;
      String ls_query = null;
      ArrayList lo_arrList = null;
      Object lo_obj[] = null;
		String ls_mercIdQuery = "";
		HashMap lo_mecrIdMap = new HashMap();
		ArrayList lo_mercIdArrList = null;
		String newuserid = "";
		String clientverf = "";
		String ls_smsStatus = null;
		String uid = null;
		String userchk = null;
		String RequestId = null;
		String operationId = null;
		String msgId = null;
		String Requestchk = null;
		String operationchk = null;
		String msgchk = null;
		String valchk = null;
		String chkReqId=null;
			try
			{

mo_logger.error("sessionId in authUser  :" +mo_HSession.getId());
                uid =(String) mo_HSession.getAttribute("usrId");
				mo_logger.error("uid from session : " + uid);
                valchk =(String) mo_HSession.getAttribute("chkId");
				mo_logger.error("valchk from session : " + valchk);
                 mo_logger.error("User Id from request ; " + request.getParameter("userId"));
                    mo_logger.error("CRN Alias From request : "  + request.getParameter("CrnAlias"));
				chkReqId=(String)request.getAttribute("chkIdReq");
				mo_logger.info("chkIdReq from request in authUser: "+chkReqId);
                 if(valchk!=null ||chkReqId!=null ){

if(valchk==null){

mo_HSession.setAttribute("chkId","1234");
					mo_logger.info("after setting the chk id in session when valchk is null ");
				  }

if (uid == null) 
				 {
				 userId = request.getParameter("userId");
				 String crnchk=checkString(userId);
			     mo_logger.error("User Id is : " + userId);
                // Code writeen by abhishek For CRN Alias
				crnalias = request.getParameter("CrnAlias");
				if(crnalias!=null){
				userchk=checkString(crnalias);
				}
				RequestId=request.getParameter("hidRequestId");
				operationId=request.getParameter("hidOperation");
				msgId=request.getParameter("hidMsg");
                if(RequestId!=null){
				Requestchk = checkString(RequestId);
				}
				if(operationId!=null){
				operationchk = checkString(operationId);
				}
				if(msgId!=null){
				msgchk = checkString(msgId);
				}

if(crnchk.equals("R") || userchk.equals("R") || Requestchk.equals("R") || operationchk.equals("R") || msgchk.equals("R")){
					 flag = false;
					 mo_logger.error("Invalid User id or Alias---redirecting to error page : ");
					 request.setAttribute("ERMSG", "KPY600");
					 lsReturnPage = "ERROR";
				}else{
				mo_logger.error("CRN Alias is : " + crnalias);
				mo_logger.error("User Id is : " + crnalias);
				if((userId == null) || (userId.equals(""))){
				ls_mercIdQuery = "select party_id from bcif.SYN_PARTY_AUDIT_INFO where crn_alias ='"+crnalias+"'" ;
				lo_mecrIdMap.put("CRN_ALIAS", crnalias);
				mo_logger.error("lo_mecrIdMap : " + lo_mecrIdMap);
				lo_mercIdArrList = mo_QInteractor.getArrayList(ls_mercIdQuery, lo_mecrIdMap);
                
                mo_logger.error("lo_mercIdArrList : " + lo_mercIdArrList);
				if (lo_mercIdArrList != null && lo_mercIdArrList.size() > 1)
				{
					mo_logger.error("Got CRN from CRN Alians" + lo_mercIdArrList.toString());
				lo_obj = (Object[])lo_mercIdArrList.get(1);
				newuserid = lo_obj[0].toString();
				mo_logger.error("New User ID : " + newuserid);
				}else
			    {
					mo_logger.error("Invalid CRN Alias");
                     request.setAttribute("ERMSG", "KPY001b");
                     	lsReturnPage = "LOGINPAGE";
				    //    response.sendRedirect(lsReturnPage);
					flag = false;
		          }
				userId =newuserid;
				}

//  code completed for CRN alias
						userPwd = request.getParameter("userPwd");
				// Added for SMS PIN
					//	smspin = request.getParameter("smspin");
					//	String IP = (String)request.getHeader("iv-remote-address");
					//	mo_logger.error("SMS PIN is : " + smspin);
					//	SMSPIN lo_smsAuth = new SMSPIN();
					//	mo_logger.info("Before calling SMSAUTH()");

// Complete SMS PIN
        ls_msg = request.getParameter("hidMsg");
         mo_logger.error("KSAuth Message First : " + ls_msg);
         KSLdapCon lo_ldapAuth = new KSLdapCon();
         mo_logger.info("Before calling userAuth()");

if (ls_msg != null && ls_msg.length() > 0)
         {
          try{
           lo_st = new StringTokenizer(ls_msg,KSConstants.MSG_DELIMITER);
           lo_st.nextToken();
           lo_st.nextToken();
           ls_merchantId = lo_st.nextToken();
           mo_logger.debug(" ls_merchantId " + ls_merchantId);
		    // ADDED by Abhishek for PG-OT 
			lo_st.nextToken();
			lo_st.nextToken();
			ls_clientId = lo_st.nextToken();
			mo_logger.debug(" ls_clientId " + ls_clientId);
	   
		   }catch(Exception e)
          {
            mo_logger.error("Ex in authUser while tokenizing message " + e.toString());
          }
         }
 
// SMS PIN Authenthication 
      /*  ls_smsStatus = lo_smsAuth.userAuth(userId , smspin,IP); 
		if (ls_smsStatus.equals("true"))
		{
			 flag  = true;
		}
		else if (ls_smsStatus.equals("lock"))
			{
			request.setAttribute("ERMSG", "KPY002sms"); 
            flag  = false;
			}
		
		else{

request.setAttribute("ERMSG", "KPY001sms"); 
            flag  = false;
		}
mo_logger.debug("KSAuth Message:-- "+ls_msg);
// end SMS PIN Authenthication */

ls_ldapStatus = lo_ldapAuth.userAuth(userId , userPwd, ls_merchantId); 
         mo_logger.debug("After Calling userAuth() return status:- " + ls_ldapStatus);
         if(ls_ldapStatus.equals("falseCon")) 
         {
             request.setAttribute("ERMSG", "KPY001a"); 
             flag  = false;
         }
         else if(ls_ldapStatus.equals("falseUser"))
         {
            request.setAttribute("ERMSG", "KPY001b"); 
             flag  = false;
         }
         else if(ls_ldapStatus.equals("falseAuth"))
         {
             request.setAttribute("ERMSG", "KPY001c"); 
             flag  = false;
         }
		   else if(ls_ldapStatus.equals("falseAuthlock"))
         {
             request.setAttribute("ERMSG", "KPY001c1"); 
             flag  = false;
         }
		    else if(ls_ldapStatus.equals("falseAuthdisable"))
         {
             request.setAttribute("ERMSG", "KPY001c2"); 
             flag  = false;
         }
         else if(ls_ldapStatus.equals("true"))
         {
			 mo_logger.debug("LDAP Status :-- "+ls_ldapStatus);

}
 
         mo_logger.debug("KSAuth Message:-- "+ls_msg);
		 if (flag)
					 {
		 
/*        
// SMS PIN ADDITION
	ls_smsStatus = lo_smsAuth.userAuth(userId , smspin,IP); 
		if (ls_smsStatus.equals("true"))
		{
			 flag  = true;
		}
		else if (ls_smsStatus.equals("lock"))
			{
			request.setAttribute("ERMSG", "KPY002sms"); 
            flag  = false;
			}
		
		else{
// SMS PIN
			request.setAttribute("ERMSG", "KPY001sms"); 
            flag  = false;*/
		 
       
//         mo_logger.debug("KSAuth Message:-- "+ls_msg);

//      userId = request.getParameter("userId");
                ls_msg = request.getParameter("hidMsg");
               // code by abhishek
			/* if((userId == null) || (userId.equals(""))){
			
				userId =newuserid;
			   }
			*/	
			// code by abhishek
                HttpSession session = request.getSession(true);
				mo_logger.error("userId from prev page : " + userId);
                session.setAttribute("usrId", userId);
                session.setAttribute("msg",ls_msg);
                mo_logger.error("userId set into session : " + session.getAttribute("usrId"));
                ResourceBundle rBundle = ResourceBundle.getBundle("KSRequestMapper");
                ls_sessionTime = rBundle.getString("SESSIONTIMEOUT");
                session.setMaxInactiveInterval(Integer.parseInt(ls_sessionTime));
                mo_logger.debug("Session set time for "+ls_sessionTime);
                mo_logger.info("User Authenticated successfully");
                //Add for user autheticate for sms pin
                  String IP1 = (String)request.getHeader("iv-remote-address");

//String userId1 = (String)request.getAttribute("usrId");
				     String userId1 =  request.getParameter("userId");
                     mo_logger.debug("Session IP1 "+IP1);
                     mo_logger.info("userId1 "+ userId1);
					 SMSPIN lo_smsAuth1 = new SMSPIN();
                 String flag1 = lo_smsAuth1.userEligibility(userId,IP1); 
				 if(flag1.equals("Y"))
		         {
					 mo_logger.info("SMS Eligibility flag "+ flag1);
					 request.setAttribute("msg",ls_msg);
                     //lsReturnPage = "SMSPAGE";
					 mo_logger.info("User is Eligible for SMS Pin");
				     response.sendRedirect("/pg/GeneratePin.jsp");

}else
		       {
                
                 uid= userId;
                mo_logger.info("ls_clientId "+ ls_clientId);
             if(!(ls_clientId == null)){
				 mo_logger.info("ls_clientId  "+ ls_clientId );
				ls_mercIdQuery = "select SVC.PKG_PGOT_SERVICE.F_CHECK_VALID_PGOT_PARTY_NEW ( '"+uid+"', '"+ls_clientId+"', '"+ls_merchantId+"' ) from dual" ;
				lo_mecrIdMap.put("V_PARTY_ID", uid);
				lo_mecrIdMap.put("V_CLIENT_ID", ls_clientId);
				lo_mecrIdMap.put("V_MERCHANT_ID", ls_merchantId);
				mo_logger.debug("inside merchange PG-OT check ls_clientId"+ls_clientId);
				lo_mercIdArrList = mo_QInteractor.getArrayList(ls_mercIdQuery, lo_mecrIdMap);
				if (lo_mercIdArrList != null && lo_mercIdArrList.size() > 1)
				{
				lo_obj = (Object[])lo_mercIdArrList.get(1);
				clientverf = lo_obj[0].toString();
				mo_logger.error("New client verificate : " + clientverf);
				} 
		   }

if(clientverf == null || clientverf.equals("N"))
                {

mo_logger.debug("PG-OT validation Failed");
                 // request.setAttribute("msg","Cleint ID not Found");
				//lsReturnPage = "LOGINPAGE";
				 request.setAttribute("ERMSG", "KPY600");
                  lsReturnPage = "ERROR";
                }
else{
			   /* PG -OT END */
                if(ls_msg == null || ls_msg.length()==0)
                {

mo_logger.debug("inside message null in authUser()");
				
				 request.setAttribute("ERMSG", "KPY002");
                  lsReturnPage = "ERROR";
                }
                else
                {
                    //ls_kmblRedirect = rBundle.getString("REDIRECTKMBLURL");
                    ls_query = "SELECT PKG_PYT_GATEWAY_REQ.F_GET_INFO_VALUE ( \'PG_MERCHANT\', \'KOTAK_PG_URL\', \' \' ) URL, "
                                   + PKG_PYT_GATEWAY_REQ.F_GET_INFO_VALUE ( \'PG_MERCHANT\', \'KOTAK_TOGETACCNUM\', \' \' ) ACCNUM FROM DUAL";
                    lo_arrList = mo_QInteractor.getArrayList(ls_query);
                    if (lo_arrList != null && lo_arrList.size() > 1)
                    {
                        lo_obj = (Object[])lo_arrList.get(1);
                        ls_kmblRedirect = lo_obj[0].toString();
                        mo_HSession.setAttribute("REDIRECTTOGETACCNUM",lo_obj[1].toString());
                    }
                    mo_logger.debug("Redirect URL :- "+ls_kmblRedirect);
                    response.sendRedirect(ls_kmblRedirect);
                                       
                }
				}

}
               //lsReturnPage = "SMSPAGE";
				//request.setAttribute("msg",ls_msg);
				}
             
               else 
				 {
			        
					request.setAttribute("msg",ls_msg);
					lsReturnPage = "LOGINPAGE"; 
				 }
				 }
				 }

else

{
                      // Added for SMS PIN
	smspin = request.getParameter("smspin");
	String smschk=checkString(smspin);
                if(smschk.equals("R")){
					 flag = false;
					 mo_logger.error("Invalid SMS PIN---redirecting to error page : ");
					 request.setAttribute("ERMSG", "KPY600");
					 lsReturnPage = "ERROR";
			    }
				else
					{

String IP = (String)request.getHeader("iv-remote-address");
	
	SMSPIN lo_smsAuth = new SMSPIN();
	mo_logger.info("Before calling SMSAUTH()");

ls_smsStatus = lo_smsAuth.userAuth(uid, smspin,IP); 
		if (ls_smsStatus.equals("true"))
		{
			 flag  = true;
		}
		else if (ls_smsStatus.equals("lock"))
			{
			request.setAttribute("ERMSG", "KPY002sms"); 
            flag  = false;
			}
			else if (ls_smsStatus.equals("Blank"))
			{
			request.setAttribute("ERMSG", "Please Enter Secure Net PIN"); 
            flag  = false;
			}
			else if (ls_smsStatus.equals("Generate"))
			{
			request.setAttribute("ERMSG", "Please generate Secure Net PIN by clicking on Generate Secure Net PIN."); 
            flag  = false;
			}else if (ls_smsStatus.equals("correct"))
			{
			request.setAttribute("ERMSG", "Please Enter correct Secure Net PIN."); 
            flag  = false;
			}else if (ls_smsStatus.equals("false"))
			{

request.setAttribute("ERMSG", "KPY001sms"); 
            flag  = false;
			}

ls_msg = (String) mo_HSession.getAttribute("msg");
mo_logger.debug("KSAuth Message:-- "+ls_msg);
// end SMS PIN Authenthication //

if (flag)
	{

if (ls_msg != null && ls_msg.length() > 0)
         {
          try{
           lo_st = new StringTokenizer(ls_msg,KSConstants.MSG_DELIMITER);
           lo_st.nextToken();
           lo_st.nextToken();
           ls_merchantId = lo_st.nextToken();
           mo_logger.debug(" ls_merchantId " + ls_merchantId);
		   /*  ADDED by Abhishek for PG-OT */
			lo_st.nextToken();
			lo_st.nextToken();
			ls_clientId = lo_st.nextToken();
			mo_logger.debug(" ls_clientId " + ls_clientId);

/*   */
          }catch(Exception e)
          {
            mo_logger.error("Ex in authUser while tokenizing message " + e.toString());
          }
         }
		
		
		
		mo_logger.info("going for PG-OT validation: " + ls_clientId);
               /*  Added by Abhishek for PG -Ot */
			if(!(ls_clientId == null)){
				
				ls_mercIdQuery = "select SVC.PKG_PGOT_SERVICE.F_CHECK_VALID_PGOT_PARTY_NEW ( '"+uid+"', '"+ls_clientId+"', '"+ls_merchantId+"' ) from dual" ;
				lo_mecrIdMap.put("V_PARTY_ID", uid);
				lo_mecrIdMap.put("V_CLIENT_ID", ls_clientId);
				lo_mecrIdMap.put("V_MERCHANT_ID", ls_merchantId);
				mo_logger.debug("inside merchange PG-OT check ls_clientId"+ls_clientId);
				lo_mercIdArrList = mo_QInteractor.getArrayList(ls_mercIdQuery, lo_mecrIdMap);
				if (lo_mercIdArrList != null && lo_mercIdArrList.size() > 1)
				{
				lo_obj = (Object[])lo_mercIdArrList.get(1);
				clientverf = lo_obj[0].toString();
				mo_logger.error("New client verificate : " + clientverf);
				} 
		   }

if(clientverf == null || clientverf.equals("N"))
                {

mo_logger.debug("PG-OT validation Failed");
                 // request.setAttribute("msg","Cleint ID not Found");
				//lsReturnPage = "LOGINPAGE";
				 request.setAttribute("ERMSG", "KPY600");
                  lsReturnPage = "ERROR";
                }
else{
			   /* PG -OT END */
                if(ls_msg == null || ls_msg.length()==0)
                {

mo_logger.debug("inside message null in authUser()");
				
				 request.setAttribute("ERMSG", "KPY002");
                  lsReturnPage = "ERROR";
                }
                else
                {
                    //ls_kmblRedirect = rBundle.getString("REDIRECTKMBLURL");
                    ls_query = "SELECT PKG_PYT_GATEWAY_REQ.F_GET_INFO_VALUE ( \'PG_MERCHANT\', \'KOTAK_PG_URL\', \' \' ) URL, "
                                  + PKG_PYT_GATEWAY_REQ.F_GET_INFO_VALUE ( \'PG_MERCHANT\', \'KOTAK_TOGETACCNUM\', \' \' ) ACCNUM FROM DUAL";
                    lo_arrList = mo_QInteractor.getArrayList(ls_query);
                    if (lo_arrList != null && lo_arrList.size() > 1)
                    {
                        lo_obj = (Object[])lo_arrList.get(1);
                        ls_kmblRedirect = lo_obj[0].toString();
                        mo_HSession.setAttribute("REDIRECTTOGETACCNUM",lo_obj[1].toString());
                    }
                    mo_logger.debug("Redirect URL :- "+ls_kmblRedirect);
                    response.sendRedirect(ls_kmblRedirect);
                                       
                }
				}
  				}
				else
				{

request.setAttribute("msg",ls_msg);
					lsReturnPage = "SMSPAGE";
				}
			}
			}
			}else{
				mo_logger.error("Invalid CRN Alias");
                request.setAttribute("ERMSG", "KPY001b");
                	lsReturnPage = "LOGINPAGE";
				    //    response.sendRedirect(lsReturnPage);
					flag = false;

}
			}
			catch(Exception ex)
			{
				mo_logger.fatalerror("Failed to retrieve data in authuser()"+ex);
				request.setAttribute("ERMSG", "KPY025");
				lsReturnPage = "ERROR";
			}
      mo_logger.info("Quiting from authuser()");
      return lsReturnPage;
		}

}//end of MsgHandler

The part of code that retrieves the userId looks OK to me. I didn't bother to take a look at the rest of the code.
To know why, please read this.

Nilesh,

browser settings if cookies are disabled

how can we do this in IE ?

For IE 6:
Tools -> Internet Options -> Privacy (Advanced)
Here check if your browser is configured to accept first party &/or third party session cookies.
Try this with a small, simple demo before coming to a conclusion.

Swati, please IsolateTheProblem

If the browser settings are disabled then you can enable the URL Rewriting setting in your servlet engine. What web/app server are you using?

Nilesh Miskin wrote:The part of code that retrieves the userId looks OK to me. I didn't bother to take a look at the rest of the code.
To know why, please read this.

That actually refers to writing code, not reading it.

@Swati: that's 1100+ lines of code to look at--as others have mentioned, it's important to IsolateTheProblem, include only the code necessary to show what's going wrong (for example, if this has anything to do with HTML, it'd only be a line or two), and make sure it's formatted (including keeping line length reasonable, so we don't have to scroll a couple of screens to the right) and nothing unnecessary is included.

There is no excuse for sloppily-formatted code or methods like authUser.