如何基于Cookie检索相应的HttpSession

Question

I would like to set up a mechanism to track every user http session based using a Cookie object. Therefore I store the user ID in a Cookie which I will communicate then to the client in the response body (once the login process is successful) such as :

Cookie loginCookie = new Cookie("userId", userId);
httpServletResponse.addCookie(loginCookie);

I have a got three questions please :

1) How to retrieve a given user http session based on his Cookie ? Shall I store the JSESSIONID instead of the userId for this purpose?

2) Encrypting the user cookie won't prevent the cookie from being compromised by some attacker eavesdroping the communication between the client and the server. Thus the attacker could reuse the cookie to request the server as being the actual user since the same cookie is being communicated each time the user requests the server. I don't really see where encrypting the cookie could help. Shall I use a digital signature algorithm as well in order to authenticate the sender?

Answer 1

1. You should store the session ID in the cookie, and the user ID in the server-side session.

2. Cookie re-use should not be an issue if you are using https, which mitigates the risk of eavsdropping. If you are not using https, no manner of encryption will help you.