Spring MVC security based on Session Attribute

Question

I am using a Security scheme that is based on session attributes. I know that Spring has Acegi Security but I don't have much time to study that module. I just want to share this to solicit comments.

The pseudocode is like this.

1. On successful Login, I am setting an attribute on user session. The object that I am placing as session attribute is a simple javabean with a map of privileges.

   public class UserInfo{ public String getRole(){}; public Map checkPrivilege(){}; //getters and setters }

2. The session attributes contains the Role also of the user. (He could be a User/Guest/Admin/Super Admin). Now there are certain privileges that are authorized to User.

For my JSP, I just check out the user session for his role and privilege.

My rough code is like this using JSTL

IF (User Info in Session is 'User' and has this privilege)
    Add Button is shown
Else
    No Add Button is shown.

I have these questions:

1. Are session attributes considered secure that no one else can sniff or hack?
2. Are security based on these scheme considered secure-enough?

Answer 1

Session attributes are stored on the server side only, so yes they are secure.

There is no problem with putting these security identifiers into session attributes in terms of security. But that is the easy part of web application security! The hard part is the rest of the security infrastructure, which I am concerned that you have not thought about yet.

I recommend you investigate Spring Security.