This is my servlet that authenticates a user and directs him/her to Lyn.jsp. However, if someone types in the URL of the file (e.g.
http:localhost.../examples/jsp/Lyn.jp), they can still access the file. This is not that secure. i want to use a session to overcome this folly of mine but i don't know how. This is my servlet (auth.java). Can someone pls take a look and show me how to insert a 'working' session. i thank you for any help that you can provide. cheers!!
------------
auth.java
------------
import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;
import java.util.*;
import java.sql.*;
public class auth extends HttpServlet {
Connection conn;
PrintWriter out;
String sqlQuery;
public void doGet(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, IOException {
String title = "Wellcome to your e-signON";
String usrname = request.getParameter("usrn
ame");
String password = request.getParameter("pass
word");
HttpSession session = request.getSession(true);
String usernameQuery = "select username from student where username = '" + usrname + "'";
response.setContentType("t
ext/html")
;
out = response.getWriter();
conn = getConnection(out);
if (conn != null) {
try { // execute the query
Statement stmt = conn.createStatement();
ResultSet rst;
rst = stmt.executeQuery(username
Query);
// Fetch the query result, and dispaly them in a table
while (rst.next()) {
if(usrname.equals(rst.getS
tring("use
rname"))) {
gotoPage("/jsp/Lyn.jsp", request, response);
} else {
gotoPage("/jsp/Error.jsp",
request, response);
}
}
stmt.close();
} catch(Exception e) {
out.println("Cannot fetch data from database!"+e);
};
}
closeConnection(conn, out);
}
public void doPost(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, IOException {
doGet(request, response);
}
private Connection getConnection(PrintWriter out)
{
String driverClassString = "oracle.jdbc.driver.Oracle
Driver";
String driverConnectString = "jdbc:oracle:thin:@teach:1
521:teach"
;
String usrname = "s4001078";
String pwd = "df991546";
Connection conn = null;
try {
Class.forName(driverClassS
tring);
conn = DriverManager.getConnectio
n(driverCo
nnectStrin
g, usrname, pwd);
}
catch (Exception e) {
out.println("Cannot close connect to database!"+e);
}
return conn;
}
private void closeConnection(Connection
conn, PrintWriter out)
{
try {
conn.close();
}
catch (Exception e) {
out.println("Cannot close database connection!");
}
}
public void gotoPage(String webAddress, HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
RequestDispatcher dispatcher =
getServletContext().getReq
uestDispat
cher(webAd
dress);
dispatcher.forward(request
, response);
}
}
