Code Review Stack Exchange is a question and answer site for peer programmer code reviews. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im using Struts2 running in google app engine.

User can use their google and facebook account to login to the site. When a user login, i have:

session.put("email", email);

When a user log-out, I have


In Struts2 Action, I have the following:

public class ChapterAction extends ActionSupport implements SessionAware{

    private static final long serialVersionUID = 1L;
    private Map<String, Object> session;

    public Map<String, Object> getSession() {
        return session;
    public void setSession(Map<String, Object> session) {
        this.session = session;

    public String add() throws Exception{
        String email = (String) session.get("email");
        if ( email == null)
            return LOGIN; 

        //business logic here

        return SUCCESS;

Please critic my code. Is the above usage of session OK and secure?


share|improve this question
up vote 4 down vote accepted

Code looks good, But why not move this Part:

String email = (String) session.get("email");
if ( email == null)
    return LOGIN; 

into an Interceptor? Or do you have only one relevant Action?

share|improve this answer

You can probably drop the getSession() method. Both OGNL and the JSP EL have mechanisms for accessing the session directly and do not require a getter method on the action. I'm guessing that you just generated the getter along with the setter.

Also, as jogep indicated, detecting the need to login would be better suited for an interceptor. This answer on Stack Overflow might help shed some light on how that works.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.