how Filters handle Session

Question

some of you advise me to handle sessions using filters . I studied a little about the filter following some guides found on the internet, and wrote a filter referring this guide .

I saw that the filter is called for every component of my page (css, images etc); is there a way to call it just when a jsp or a servlet is load? I need a method that can understand if jsp or a servlet is load, in order to make some stuff inside my filter.

Answer 1

Yes, you can do that. Just change the url-pattern for your session filter.

If you are using some web framework (spring mvc,...) with one dispatching servlet, you can map your filter only to this servlet using servlet-name and requests to other resources (js, css) will not be intercepted by this filter.

Answer 2

First off, please don't be misled by the purpose of the tutorial in the link you have specified. Session handling is always done through cookies, URL-rewriting (or for the more advanced, SSL). He's merely using filters to enhance application security , by ensuring the user is redirected to the login page, whenever he goes directly to an "avoid-url".

Think about a filter, a physical filter. Whether it be an excel filter or a physical gravel filter. It stands between one thing and another thing:

Java web filters can do the same thing:

Just like you can choose which water bottle to filter, you can decide which requests you want to filter. You do that using the filter-mapping element in web.xml . You can specify individual servlet names, or a url pattern.