Pass session from JSP to servlet?

[Lido Collins]

I've been scouring docs, tutorials and forums for a few hours now and can't find out the answer. Is there a way to pass a session from a jsp to a servlet? I have the following setup so far:

index.jsp has a form for username/pw and an action(POST) to send the attributes to a Login servlet.

The login servlet logs them in and with forward(req,res) sends them to welcome.jsp.

Welcome.jsp has a form for users to enter search params which are then sent via a form action(using GET) to Search servlet.

At this point the session is gone and so is the connection to the database and user info.

Any solution to this? Is my design trash? What would you recommend? Thanks.

[Christophe Verré]

At this point the session is gone

What do you mean by "gone" ? It doesn't evaporate
In you login servlet, do you call getSession() ?

[Lido Collins]

Yes, I call this in Login:

HttpSession userSession = req.getSession(true);

But when I get to the second servlet (ie after Login uses forward(req,res) to welcome.jsp and welcome.jsp calls Search servlet from it's form), there doesn't seem to be a way to get the session.

requst is new so request.getSession() won't work right?

[Christophe Verré]

requst is new so request.getSession() won't work right?

Wrong. New request doesn't mean new session. The session created when getSession(true) was called will be available for all requests.

[Lido Collins]

Well, I don't know what's happening. I set up a session and db connection in Login servlet and then do this:

rd = getServletContext().getRequestDispatcher("/welcome.jsp");
if (rd != null)
   rd.forward(req,res);

Then in welcome.jsp we have this:

<FORM METHOD=GET ACTION="servlet/Search">

Then in Search servlet I've got this, but I can't get the connection object or anything else from the session. req.getSession() seems to give us a new session and req.getSession(false) doesn't seem to do anything to help. Here's some of the code from Search.java:

public void doGet(HttpServletRequest req, HttpServletResponse res)
throws ServletException,IOException{
 
RequestDispatcher rd;// set up vars and objects for the doPost
ResultSet rs = null;
HttpSession userSession = req.getSession();
 
try
{
rs = getResults(params, rs, userSession);
}
catch (Exception e)
{
PrintWriter ot = res.getWriter();
e.printStackTrace(ot);
ot.close();
}
 
if (userSession.getAttribute("userId") == null)
{// not a valid user send to login page (aka index.jsp)
rd = getServletContext().getRequestDispatcher("/index.jsp");
 
if (rd != null)
rd.forward(req,res);
return;
}
else{// user is valid, send to display results page
rd = getServletContext().getRequestDispatcher("/listResults.jsp");
 
if (rd != null)
rd.forward(req,res);
return;
}

Here's the stack trace:

java.lang.NullPointerException
at Search.getResults(Search.java:87)
at Search.doGet(Search.java:53)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:689)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:80)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684)
at java.lang.Thread.run(Unknown Source)

Here is line 86 and 87:

Connection con = (Connection) userSession.getAttribute("connection");
Statement stmt = con.createStatement();

[Vishnu Prakash]

HttpSession userSession = req.getSession(true);

Why do you get a pre-existing session in login servlet. If a user visits for the first time then this servlet will return a null.

Instead use

HttpSession userSession = req.getSession();

in your login servlet.

[Lido Collins]

If I don't put (true) in getSession in Login servlet, the user can't log in. Probably the way the code is written. Either way, that doesn't seem to be the problem in Search servlet does it?

[Vishnu Prakash]

Mind posting your login servlet code.

[Lido Collins]

I can't post the whole thing, but here is all the relevant lines (pretty much the whole thing):

import java.sql.*;// methods to process SQL commands
import javax.sql.*;// ditto
import org.postgresql.jdbc3.Jdbc3PoolingDataSource;// connection via JDBC to postgrSQL
import java.io.IOException;// enable IOException objects & handling
import java.io.PrintWriter;// enable PrintWriter (so can use .println())
import javax.servlet.http.*;// provides servlet functionality
import javax.servlet.*;// ditto
 
public class Login extends HttpServlet{
 
private static DataSource ds;
 
public void doPost(HttpServletRequest req, HttpServletResponse res)
throws ServletException,IOException{
 
String email = req.getParameter("email");
String password = req.getParameter("password");
 
/************************************************************
** call a method to validate the password which will return the
** User Name for authorized users and null string for un-authorised.
**********************************************************/
Connection con = null;
int userId;
    try
    {
userId = validateUser(email, password, con);
}
catch (Exception e)
{
userId = -1;
}
 
RequestDispatcher rd;
 
// if uName is negative .. user is not authorized.
 
HttpSession userSession = req.getSession();
 
userSession.setAttribute("connection", con);// put connection into Session for later use
 
if (userId < 0)
{
userSession.setAttribute("userId", userId);
 
rd = getServletContext().getRequestDispatcher("/index.jsp");
 
if (rd != null)
rd.forward(req,res);
}
else{
// So the user is valid let's create a session for this user.
 

// put the session variables.
userSession.setAttribute("userId", userId);
 
// now we need to set response page to welcome.jsp
 
rd = getServletContext().getRequestDispatcher("/welcome.jsp");
 
if (rd != null)
rd.forward(req,res);
}
 

 
}
 
public int validateUser(String email, String passwd, Connection con)
   throws SQLException{
int userId = -1;
con = ds.getConnection();
Statement stmt = con.createStatement();
String sql= "SELECT id FROM users WHERE email = '" +
   email + "' AND password = '" + passwd +"' ;" ;
ResultSet rs = stmt.executeQuery(sql);
if (rs.next())
{
  userId = rs.getInt(1);
}
stmt.close();
return userId;
}
 
// upon iniut of servlet, open the test database
public void init() throws ServletException
{
Jdbc3PoolingDataSource source = new Jdbc3PoolingDataSource();
    source.setDataSourceName("Tomcat Talking to PostgreSQL");
    source.setServerName("localhost");
    source.setDatabaseName("moviedb");
    source.setUser("vincent");
    source.setPassword("vc1986");
    source.setMaxConnections(10);
ds = source;
  }
 
}// end of servlet class

[Vishnu Prakash]

You cannot bind an interger to a session.

userSession.setAttribute("userId", userId);

Here userId is an int.

[Lido Collins]

Do you think this is the problem? I think it autoboxes to a string or something because userId is available in the jsp which is called by login:

<!-- Hi <%= session.getAttribute("userId") %> -->

shows as:

<!-- Hi 490002 -->

when I view source on the page.

- as I said, the main problem I'm having is that the session is gone when I call a second servlet from a form in a jsp (which was called by Login servlet).

[Sarath Mohan]

As you said your session is getting recreated. where exactly I couldn't figure out. try with .getSession() and see why is it becoming null...

You can opt for a better design where we can avoid db connection in Session.

[Lido Collins]

I'd be up for hearing about a better design, but I couldn't figure out a better one. I'm not confident I could set up JNDI and even if I did I might still have this problem if I was using multiple servlets. Maybe I could do it in a way where the servlet doesn't need anything from the session and just gets information via forms, but can I pass an arraylist from the servlet to a jsp in the response without disturbing the user's existing session (since the servlet won't have access to it)?

[Jeroen T Wenting]

Originally posted by Vishnu Prakash:
You cannot bind an interger to a session.



Here userId is an int.

You can when using a 1.5 compliant JVM, autoboxing would turn it into an Integer.

[Tom Tillinghast]

Lido, your connection is never set to anything other than null. So it should be no surprise that your connection is null in
line 86 of Search.java:
Connection con = (Connection) userSession.getAttribute("connection");

In your Login class:
Connection con = null;
int userId;
try {
userId = validateUser(email, password, con);//does NOT modify con
}
catch (Exception e){
userId = -1;
}
RequestDispatcher rd;
// if uName is negative .. user is not authorized. HttpSession userSession = req.getSession();
userSession.setAttribute("connection", con);//con is still null here

Inside of validateUser(), you set the LOCAL variable con -- INSIDE THAT FUNCTION, but that has no relevance to the outside variable con that you see above. You're not modifying it (it's null anyway so you couldn't), you're just setting the FUNCTION'S con variable to another reference.
You would need to pass in a structure containing a connection object
and then set that structure's connection object inside the function.

[William Brogden]

<FORM METHOD=GET ACTION="servlet/Search">    

That looks like you are using the "Invoker" servlet - this causes all sorts of problems and confusion. See this ranch faq.
Sessions can only be shared between JSP and servlets in the same "web application" - you need to be sure that your URLs for JSP and servlets all point to the same web application.
Bill

[Lido Collins]

Tom,

Thanks! I did not notice that. I solved the problem by just getting a new connection in the Search servlet, but I will go back and see if I can share the connection that way.

William,

Thanks for the link to the FAQ. I did not uncomment the invoker so I think I'm ok there, but the faq did point out that the web.xml couplets for the servlets should be grouped together by type rather than in pairs. Although mine seems to be working as is, I will change the web.xml to be grouped by type rather than how they are now (in pairs by servlet).

<!--
    <servlet>
        <servlet-name>invoker</servlet-name>
        <servlet-class>
          org.apache.catalina.servlets.InvokerServlet
        </servlet-class>
        <init-param>
            <param-name>debug</param-name>
            <param-value>0</param-value>
        </init-param>
        <load-on-startup>2</load-on-startup>
    </servlet>
-->