How to use session variables on JSP safely in strut

Question

I am printing some values on a JSP from session using < bean:write /> successfully. But after submitting the page if I come back (after session expiry) and refresh page it print complete strack trace on the page saying;

< session attribute name> not found in session scope.

To avoid this I have done 2 things. But nothing worked for me.

I had wrapped < bean:write /> inside < logic:empty />
In the starting of the page I just checked whether value of < session attribute name> is null. If so, I am redirecting it to error page.

Same problem I am facing if I add attributes in request instead of session.

< request attribute name> not found in request scope.

Code from JSP to check session

HttpSession sess = request.getSession(false); 
if (sess == null) {response.sendRedirect("errorpg.jsp");} 
else{
    String sessionId_Logon = (String) sess.getAttribute("attrName");
    if(sessionId_Logon == null)
    {
            response.sendRedirect("errorpg.jsp");
    }
}

I know that "else" block is sense less. I had tried it alone as well.

score 0 · Answer 1 · answered Jul 25 '12 at 18:51

0

May be this can help you.... its working fine with me..

<logic:empty name="employee" scope="session"> <jsp:forward page="LoginScreen.do"/> </logic:empty>

Welcome Mr. <bean:write name="employee" scope="session"/ >

answered Jul 25 '12 at 18:51

Dipen Thakkar

139
1
5

score 0 · Answer 2 · edited May 23 '17 at 11:48

0

I'd be more inclined to check if the session is valid once on the page, and then inform the user if it has expired. See something like this thread or this one for some ideas on what to do.

edited May 23 '17 at 11:48

Community

1
1

answered Jan 10 '12 at 05:13

Mr Moose

5,946
7
34
69

It seems as though you are checking for the session attribute, but not whether the session is valid in the first place. At least that was how I interpreted point 2 in your question. Can you show how you are checking that the session has expired? – Mr Moose Jan 10 '12 at 05:32
If the sessionattribute is no longer in the session after the initial session expiry, then it is quite possible that the page that initialises attrName hasn't been visited since the new session was created. Also, are you only allocating new session id's at a certain point in the application? It could be that some filter or included jsp or something is allocating a new session when one isn't detected, and therefore your request.getSession(false) will always return a valid session. Without knowing your app, I'm just guessing now though. – Mr Moose Jan 10 '12 at 06:37
There is only one place where I am creating session using request.getSession(). then forwarding to mentioned JSP. If session is expired and cpntrol comes to this JSP again looks into session attrbute before any check. So the err is coming – Amit Kumar Gupta Jan 10 '12 at 06:41

score 0 · Accepted Answer · answered Jan 10 '12 at 06:45

Well! I had found the problem i guess. < bean:write /> is getting compiled before than anything else. So my external checking for session is sense less.

Now i have 2 solutions;

Either i dont use < bean:write /> . Instead i can use scriptlet
Or I Can check for session validity on some page upper in hirarchy like some master page.

I am using the second one.

How to use session variables on JSP safely in strut

3 Answers3