Trying to retrieve the user from session with FacesContext

[Ed Herrero]

Hello,

I'm currently trying to retrieve all the data from the user that is logged in so I can use it for example listing his emails or his contacts, or to modify or add new ones.

At the beginning, in the login screen, I use a method to put that user in session.

    private void putUserInSession(Usuario user) {
    Map<String, Object> session = FacesContext.getCurrentInstance()
            .getExternalContext().getSessionMap();
    session.put("LOGGEDIN_USER", user);
}

And to retrieve that user to show in a page his personal data in order to modify and update it, I use the following one in a call inside a .xhtml page, so as it returns "exito" (success) it will take me to the edit page.

    public String proceed(){
    Usuario usermodificar = (Usuario) getObjectFromSession("LOGGEDIN_USER");
    usuario.setUsuario(usermodificar);
    return "exito";
}

    private Object getObjectFromSession(String key) {
    return FacesContext.getCurrentInstance().getExternalContext()
            .getSessionMap().get(key);
}

I try to set the bean values to the user in session, but no data is shown.

I also try to retrieve it inside other beans, like to save a given email inside the users account (so I need his or her ID)

Usuario usuario = (Usuario) getObjectFromSession("LOGGEDIN_USER");

But it doesn't work like the previous case, no values are shown in the page where I want to edit the information of the user logged in. It doesn't show also the emails of that person.

Hope you can help me out a little bit with this.

[Arun Kumarr]

When you move from one page to another, are you sure you have the same session object?

[Ed Herrero]

Arun Kumarr wrote:When you move from one page to another, are you sure you have the same session object?

Hm... It shouldn't change (I hope), I don't modify the user bean anytime and being a session bean should take care of it until the session is finished. How can I check the session object between pages?

[Arun Kumarr]

Did you check if there are any methods in session to tell the coder the identifier of the session?
Perhaps something like - .getSession(false boolean create).getId()?
See if the session id is the same?

[Ed Herrero]

I've done two methods to check both getSessionMap and getSession as I was not sure.

	public int checkSessionHashcode(){
		int usuario = getObjectFromSession("LOGGEDIN_USER").hashCode();
		return usuario;
	}
	
	public int checkSessionId(){
		int usuario = getObjectFromSession2().hashCode();
		return usuario;
	}

        private Object getObjectFromSession(String key) {
		return FacesContext.getCurrentInstance().getExternalContext()
				.getSessionMap().get(key);
	}
	
	private Object getObjectFromSession2() {
		return FacesContext.getCurrentInstance().getExternalContext()
				.getSession(true);
	}

And while the hashCode for the SessionMap remains the same, the one for the Session changes, then the session is not the same it seems...

Now I don't really have any idea what's going on here... Why would the session change between pages if its the same user who is navigating through it? Is there any way to solve it?

[Arun Kumarr]

What does the getSession(boolean create) method do?
Since you have specified true as an argument, if there is existing session, it will create one and give it to you.
If you specify false, what do you think will happen?

[Ed Herrero]

That it will return the reference to the session that exists, and null if it doesn't exist one. But I've already tried changing it to false and the hashcode for the getSession method keeps changing, and if it already finds that there's one created, the hashcode should be the same, or not?

[Arun Kumarr]

Why are you not using the id of the session to differentiate sessions?

[Arun Kumarr]

you need to print the session id in your "putUserInSession" and also print the session id in "getObjectFromSession" method?
Check if both the printed ids are the same.
If not, then you are adding elements to a different session and you trying to get elements from a different session.

[Tim Holloway]

First and foremost. User-designed login/security systems are almost invariably extremely insecure.

J2EE has a built-in standard security system. It is well-documented, has a history of actually being secure, and the J2EE knows how to work with it, which is more than can be said for user-designed security code. I highly recommend it.

However, if you MUST donate yet another systems to be the play-toy of hackers around the world, don't mess around with all this JSF-specific logic. Just define a session-scope backing bean, inject it into your login bean and use POJO property access methods to set and get the values you want. You can then inject that same object into any other JSF managed beans that need access to the user information.

There is no need to obtain the FacesContext. JSF will set things automatically for you if you design according to Inversion of Control (IoC) principles with no JSF-specific code required at all.

If you have non-JSF components in the webapp (servlets and/or JSPs), a JSF session-scope object is the same thing as an ordinary J2EE session object and can be retrieved the same way as any other session-scope object. The sole difference is that JSF will automatically construct and initialize manageg beans as needed whereas in straight non-JSF logic you have to do that stuff manually.

[Ed Herrero]

Problem solved :). It seems that in the business layer, the method in charge of sending a User object with the values of the one who is login was sending an empty one.

[Kishorg Kumarn]

Ed Herrero wrote:Problem solved :). It seems that in the business layer, the method in charge of sending a User object with the values of the one who is login was sending an empty one.

Can you please make it clear, how it has been solved. Because I have the same problem.
What about the jsessionid when you are storing an object in the session and again the jsessionid when you are obtaining the object from the session?