How to secure session variable in HttpSession using java servlets

Question

I think there should a way to set session variable with defined scope in pure java Servlet without using other library like jsf or springframework so that visibility of session variable can be restricted.

public void doGet(HttpServletRequest request, HttpServletResponse response) {
    HttpSession session = request.getSession();
    String userId = (String)request.getAttribute("userId");
    session.setAttribute("userId", userId);
}

I found ServletContext

ServletContext context = request.getSession().getServletContext();
context.setAttribute("userId", userId);

but this one doesnot seem to provide session scope flexibility.

Answer 1

You've found it. Set a session attribute. The scope of a session attribute is the scope of a session, which is a single user.

The portlet scope just controls whether the attribute is confined to the current portlet or is visible to all portlets. It's still within the user session. If you need to implement that feature, just bind a Map into the session under the name of the portlet, and have each portlet look in its own Map.

If you set a context attribute it will be visible to all users.