Session attribute being accessed by another session

Question

On a jsp page, attributes are accessed such as: List = (List)request.getAttribute("object");

we have multiple users on a server with independent sessions. Intermittently, we have been noticing that UserA is seeing UserB's request attributes.

EXAMPLE: UserA has a request attribute "object" set that has 3 elements: ABC

UserB has a request attribute "object" set that has 3 elements: DEF

At some point during their session, when UserA tried to access the attribute "object", the elements returned are: DEF

which are elements stored in UserB's request attribute.

Any ideas how this could happen?

Answer 1

First of all

request.getAttribute("object"); 

is returning a request attribute not a Session attribute. To get a Session attribute you need to use

request.getSession().getAttribute("object");

Also watch out for using instance variables in your Servlets, they are shared between requests.