Servlet会话Cookie篡改和安全性

Question

On the server side, after a successful logon, I execute :

HttpServletRequest request = this.getThreadLocalRequest();
HttpSession session = request.getSession();
session.setAttribute("user", subject.getUser().getId());
session.setAttribute("logged", true);

I then assume that the user is logged in. When the user navigates to a secure page in order to save or delete a record from my database, I run this code.

HttpServletRequest request = this.getThreadLocalRequest();
HttpSession session = request.getSession();
if (session.getAttribute("user")!=null && session.getAttribute("logged"))
{
     //delete a record using the authority of the user.
}

My concern is that a client can tamper its browser cookie with a different user id. The database request would be initiated with a different user, skipping the login process.

Can java session identify tampering, or should I digitally sign the session by including this line

session.setAttribute("signature", hash(secretkey + subject.getUser().getId());

then verify that the signature is valid before changing the database.

if (session.getAttribute("signature").equals(hash(secretkey + session.getAttribute("user"))
{
    //delete a record using the authority of the user.
}

Answer 1

Have you examined your cookies? Are you actually keeping the user-id in a cookie, and if yes, what for? The server side session object can't be accessed from the client side, that would be a huge security problem.

If your code is correct, there's no reason or advantage in using a hash.