如何将session.attribute从jsp保留到servlet

Question

I have a Login Servlet where i set the attribute user logged:

protected void doPost(HttpServletRequest request, HttpServletResponse response)
                    throws ServletException, IOException 
                              ... OMITTED
    request.getSession().setAttribute("user", user_name);
    request.getRequestDispatcher("index.jsp").forward(request, response);
                              ... OMITTED
    }

From the index.jsp I go to my quit.jsp, until here i can access to the user logged through getAttribute() . But in my quit.jsp, I ask the user logged just for his password and call the Quit Servlet. The problem is that in the Quit Servlet when I try to access to the current user logged with getAttribute() , the attribute "user" is null. So my question is: how can I use a persistent attribute created in a servlet which will be used in jsp and servlets?

Answer 1

In a JSP file, the HttpServletRequest is available with variable name request by default. You can use it same way in the JSP file too.

So

request.getSession().setAttribute("user", user_name);

will be available in JSP file also.

<%
request.getSession().setAttribute("user", user_name);
%>

Answer 2

Your problem might not be so easy to solve. I have had a similar situation so I can give you some investigation pointers:

The cause of your null data is that when your session (where the attribute is stored) dies, times out, is re-created because the same user issues a new Login POST then your custom session data dies with it, unless you store it referenced as a session_id in a persistent storage such as a Cookie on the user browser, or a database for each user: but this can be quite complex to implement.

As a short cut:

Check out this method documentation in HttpServlet: getThreadLocalRequest().getSession(false);

and this as well which might solve your problem:

request.getSession().setMaxInactiveInterval(3600); // Max intervals in seconds between calls prior to invalidate session. This means that after one hour you will need to auto-logout your user (or force him to re-login) to prevent a null being encountered.

a logout would call:

session.removeAttribute("attribute"); session.invalidate();

Also note that you mention having 2 distinct servlets (defined in Tomcat web.xml ??). One is Login the other is Quit, they both respond to POST/GET. I suppose they have two different implementations and I think that they do not share the same session object. So in this case you might have to implement the Login + Quit actions in the same servlet with a proper session invalidation time interval.