Solved

Session Login And Logout

Posted on 2003-11-30
7
166,555 Views
Last Modified: 2011-08-18
Hi there,

I’m currently on an application that has an administrative module. I’m experiencing problems in clearing the sessions so as to log a user out and also to login as an admin and as a user of the application. I’m using a Java Bean for this purpose.


This is the code to check to see if there is a login session as an administrator or as a user. If there is no login session, the page will display a noAuthority.jsp ….. else it will show the page contents.

<%@ page contentType="text/html; charset=iso-8859-1" language="java" import="java.sql.*" errorPage="" %>

<jsp:useBean class = "Beans.User" id = "userid" scope = "application"></jsp:useBean>
<jsp:setProperty name = "userid" property = "*"/>

<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>

<%if (session.isNew()==true)
response.sendRedirect(response.encodeRedirectURL("login.jsp"));%>

<%
boolean userAdmin = userid.checkUser();
if (userAdmin == false)
{%> <jsp:forward page = "noAuthority.jsp" /> <%}
else
{%>
<%
String loginName = userid.getUserName();
String loginPass = userid.getUserPass();
%>

Username: <% out.println(loginName); %> <br>
Password: <% out.println(loginPass); %> <br>
<h5> Hello, <%= userid.getUserName() %> You are Authorized! </h5> <br>
<b>Session ID: </b><%= session.getId() %><br>
<a href = "LogOut.jsp">logout test</a>

<%}%>

</body>
</html>


This is the Login_action page to process the login session with validation for username and password. The admin username is hardcoded and usernames are stored in a MySQL database.


<%if (session.isNew()==true)
response.sendRedirect(response.encodeRedirectURL("login.jsp"));%>

<!-- Validation Page for Login-->
<!-- Open connection and execute query -->
<%
Class.forName("org.gjt.mm.mysql.Driver");
Connection connection = DriverManager.getConnection("jdbc:mysql://localhost:3306/test", "root", "");
Statement statement = connection.createStatement();
%>

<% ResultSet rs = statement.executeQuery("Select * from users"); %>
<%
boolean userValidate, passValidate;
userValidate = false;
passValidate = false;
String name = " ";

if (rs != null)
      {while (rs.next())
            {name = rs.getString("Username");
                        if (name.equals(request.getParameter("usernm")))
                              {userid.setUserName(name);
                              userValidate = true;
                              session.setAttribute("Pass-name", name);
                              session.setMaxInactiveInterval(60);
                               String pass = rs.getString("password");
                                    if (pass.equals(request.getParameter("pass")))
                                          {userid.setUserPass(pass);
                                          passValidate = true;}}}}

if (userValidate==true && passValidate == true)
      {response.sendRedirect(response.encodeRedirectURL("success.jsp"));}
            
else if (userValidate==true && passValidate == false)
{out.println("Password Error! Pls Try Again.");
%> <a href = "login.jsp"> BACK </a> <%}

else
{out.println("User Name Error! Pls Try Again.");}

%>




This is the logout page code. Basically clears the session created during the login.

<body>

<%if (session.isNew()==true)
response.sendRedirect(response.encodeRedirectURL("login.jsp"));%>

<%session.invalidate();%>
<h4> You were being Logged out </h4> <br>
<a href = "login.jsp"> Login </a><br>
<b>Session ID: </b><%= session.getId() %>
</body>


Currently, the problem that I’m facing is that when I logout of the application, I’m still able to access a page by typing the URL of the page into the browser twice. For example,
http://localhost:8080/newtemplate/create_user.jsp

Also, sometimes, there is an error page that shows the message; forward statement cannot proceed because a response has been committed.

Any help on this is greatly appreciated.
0
Comment
Question by:keneticintrouble
  • 4
  • 2
7 Comments
 

Author Comment

by:keneticintrouble
Comment Utility
Additional Queries:

I'm using the Tomcat Web Server to host the JSP so is there such a thing as a tomcat cache that stores sessions?? If so, how can i clear that because i think my codes recognise that as a session instead of the admin module's session.

Thanks again
0
 
LVL 92

Accepted Solution

by:
objects earned 80 total points
Comment Utility
> <%if (session.isNew()==true)

You need to do more than that, that only checks if session has just been created. So the 2nd time the page is loaded it will return false.
0
 
LVL 92

Expert Comment

by:objects
Comment Utility
You need to check userid to see if it contains an authenticated user.
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 92

Expert Comment

by:objects
Comment Utility
> <jsp:useBean class = "Beans.User" id = "userid" scope = "application"></jsp:useBean>

That should also have session scope, and not application.
0
 
LVL 4

Assisted Solution

by:kokchoon78
kokchoon78 earned 70 total points
Comment Utility
>>Also, sometimes, there is an error page that shows the message; forward statement cannot proceed because a response has been committed.

That is because the response has been committed after you try to redirect to another page :

Try to move your sendRedirect method before any html tags.

for example :

<%@ page contentType="text/html; charset=iso-8859-1" language="java" import="java.sql.*" errorPage="" %>

<jsp:useBean class = "Beans.User" id = "userid" scope = "application"></jsp:useBean>
<jsp:setProperty name = "userid" property = "*"/>

<%if (session.isNew()==true)
response.sendRedirect(response.encodeRedirectURL("login.jsp"));%>

<%
boolean userAdmin = userid.checkUser();
if (userAdmin == false)
{%> <jsp:forward page = "noAuthority.jsp" /> <%}
else
{%>

<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
...

objects is correct, try to use the following to check the session :

if (session.getAttribute("Pass-name") != null )



0
 

Author Comment

by:keneticintrouble
Comment Utility
Dear Participants,

All your help has reaped success!!! I've managed to solve the problem.

With regards to objects, i can't use the scope="session" but the scope="application" tag. The former will constantly "lock" me out of the application, even if i'm logged on as the administrator.

The code that i've amended is listed below:

<% boolean userAdmin = userid.checkuser();
%>

<% if (session.isNew() == true || userAdmin == false || session.getAttribute("Pass-name") == null)
{
response.sendRedirect(response.encodeRedirectURL("login.jsp"));
}

else {

displayed contents here......


}
%>

0
 
LVL 92

Expert Comment

by:objects
Comment Utility
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
decryption not working 5 80
Jquery ajax file upload not working 11 143
gZip compression filter 2 88
servlet concurrency 13 84
HOW TO: Connect to the VMware vSphere Hypervisor 6.5 (ESXi 6.5) using the vSphere (HTML5 Web) Host Client 6.5, and perform a simple configuration task of adding a new VMFS 6 datastore.
This article explains how to prepare an HTML email signature template file containing dynamic placeholders for users' Azure AD data. Furthermore, it explains how to use this file to remotely set up a department-wide email signature policy in Office …
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now