What Is the Proper Place To Create A Session Object?

[JiaPei Jen]

I want to create a session and set user's name after users successfully log in:
HttpSession session = request.getSession( );
if ( session.isNew() )
{
student.setName(request.getParameter("username"));
session.setAttribute("student", student);
}
I have a number of servlets and JSPs in my application. I hesitate to create the session object in a JSP because JSP is presentation centric. Do I have to create session objects in a servlet?

[Vivek Mongolu]

Hey
a good programming practice is to create a Bean which does login and authentication.Make this bean as a session scope in JSP files.
lemme know if you need more info

Vivek

[Marty Hall]

I want to create a session and set user's name after users successfully log in:
HttpSession session = request.getSession( );
if ( session.isNew() )
{
student.setName(request.getParameter("username"));
session.setAttribute("student", student);
}

Do not use isNew for this! The problem is that sessions are user-specific, not servlet-specific. So, isNew will return false in your example if the session already exists (because some unrelated servlet or JSP page in your Web app created it), even if there is no "student" attribute.
Instead, you should do session.getAttribute("student") and see if it is null.

I have a number of servlets and JSPs in my application. I hesitate to create the session object in a JSP because JSP is presentation centric. Do I have to create session objects in a servlet?

The system automatically creates session in JSP pages and binds them to the predefined _jspService local variable called "session". This is true except if you do <%@ page session="false" %> (which does not disable session tracking, but merely prevents the JSP page from making a new session if it didn't already exist).
Cheers-
- Marty

[JiaPei Jen]

Marty, thanks for your reply. Does it mean that I can code

<%
   String s = "something";
   session.setAttribite("key", s);
%>

in one of my JSP. Later on, I can retrieve the String s from the session object in one of my "other" JSPs or servlets?
After all, is JSP a proper place to code

<%
   String s = "something";
   session.setAttribite("key", s);
%>

regardless that JSP is presentation centric and it is bad to have java code in JSP?

[Pradeep bhatt]

For the first question the answer is yes.
JSP is used for presentation purpose, so java is to be avoided. This makes it easier for a web developer who doesn't know java. Expression language helps to avoid all java code . It syntax is similar to javscript making it easier for someone who know JS to pick up the langauge very quickly.

[Juan Rolando Prieur-Reza]

Originally posted by Marty Hall:

...
The system automatically creates session in JSP pages and binds them to the predefined _jspService local variable called "session". This is true except if you do <%@ page session="false" %> (which does not disable session tracking, but merely prevents the JSP page from making a new session if it didn't already exist).
...

The _jspService would seem to be equally useful for the following variation of the original question in this thread: I want an unlogged-in user session to be created upon initial connection; and then, when the user authenticates (through a bean, as you mentioned), retain the same _jspService session. Assuming that a stateful session bean will be activated on the server, the _jspService could hold the handle to that SFSB.
Does this seem reasonable? what you suggest? (thanks in advance!)

[JiaPei Jen]

The set up of my application is different. I use container managed form-based authentication; i.e. the container intercepts and takes over after a user fills out his/her name, password, and clicks on the submit button.
My difficulty is that it is a JSP right after the container returns control to my application. If I create a session object for this user, I am going to clog my JSP with lots of java code.
What should I do?

[Marty Hall]

Does it mean that I can code

<%
   String s = "something";
   session.setAttribite("key", s);
%>

in one of my JSP. Later on, I can retrieve the String s from the session object in one of my "other" JSPs or servlets?

Yes, from a syntax point of view this is perfectly legal. But, from a design/style point of view, you might consider whether your JSP page should set session attributes. Maybe it should just get them? I don't think this must be a hard and fast rule, but it often is easier if the JSP page merely presents the data that a servlet created. You also might want to consider using jsp:useBean with scope="session" instead of explicit calls to session.getAttribute. (Or, if you are using JSP 2.0, you can use the expression language for even simpler and more concise code.)
Cheers-
- Marty

[Ko Ko Naing]

Originally posted by JiaPei Jen:
I want to create a session and set user's name after users successfully log in:
HttpSession session = request.getSession( );
if ( session.isNew() )
{
student.setName(request.getParameter("username"));
session.setAttribute("student", student);
}
I have a number of servlets and JSPs in my application. I hesitate to create the session object in a JSP because JSP is presentation centric. Do I have to create session objects in a servlet?

For me, I always do such kind of session creating, handling and modifying in servlets, which is supposed to be controllers of a web application...
But I think it depends on the individual's favourite as well...

[Ko Ko Naing]

Originally posted by Pradeep Bhat:
For the first question the answer is yes.
JSP is used for presentation purpose, so java is to be avoided. This makes it easier for a web developer who doesn't know java. Expression language helps to avoid all java code . It syntax is similar to javscript making it easier for someone who know JS to pick up the langauge very quickly.

Hey Pradeep,
As for me, I learnt Java first, then go for JavaScript, when I was in the university... At that time, I feel a little bit strange of JavaScript Syntax and Variables usage... Even though Java and JavaScript are similar, I found many weakness of JavaScript technology at that time... But for the client side manipulation, JavaScript is incredibly powerful and fast... I did like it afterwards...
Just want to share my experience...