Gavi, It checks for a valid session by checking for a session attribute that was assigned to the session when it was first created. The attribute assigned corresponds to the role of the user (when they logged in).
Jeanne, I already thought about making the url-pattern alike for servlets, it's just huge work because I have lots of servlets. Consider the jsp's that <a href= or <form action= to these servlets. If reg.exp. was available however, I could probably just say !(/images/ | /js/) and stuff.
The idea is to validate a user for every request. However, I don't want it to be applied to a request for images or javascripts and such. I only want it to be applied to a request for servlets and JSP's.
Is it possible to use reg-exp for <url-pattern>? If not, what is the best way to do this?
I have a clear understanding of the difference between RequestDispatcher.forward(request, response) and HttpServletResponse.sendRedirect(...). I was just wondering however, if it is possible to change the URL (on the address bar) after a RequestDispatcher.getRequestDispatcher("/someJSP").forward(...) to "http://host/app/someJSP" ?
Why is the Filter better than the Listener in this case? Seems like there's a lot of work involve using Filters. Is that the most commonly used pattern?
Here's the deal: 1. User logs in 2. After 10 min. their session times out (using <session-timeout> 3. After that, I want them to be redirected to a timeout page or display a message (not using javascript).
you probably have this jsp page included in another jsp page. in that case, you can't use response.sendRedirect() because the response is already committed hence, the error...