Take the 2-minute tour ×
Code Review Stack Exchange is a question and answer site for peer programmer code reviews. It's 100% free, no registration required.

Im using Struts2 running in google app engine.

User can use their google and facebook account to login to the site. When a user login, i have:

session.put("email", email);

When a user log-out, I have

session.remove("email");

In Struts2 Action, I have the following:

public class ChapterAction extends ActionSupport implements SessionAware{

    private static final long serialVersionUID = 1L;
    private Map<String, Object> session;

    public Map<String, Object> getSession() {
        return session;
    }
    public void setSession(Map<String, Object> session) {
        this.session = session;
    }

    public String add() throws Exception{
        String email = (String) session.get("email");
        if ( email == null)
            return LOGIN; 

        //business logic here

        return SUCCESS;
    }
}

Please critic my code. Is the above usage of session OK and secure?

Thanks

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Code looks good, But why not move this Part:

String email = (String) session.get("email");
if ( email == null)
    return LOGIN; 

into an Interceptor? Or do you have only one relevant Action?

share|improve this answer
add comment

You can probably drop the getSession() method. Both OGNL and the JSP EL have mechanisms for accessing the session directly and do not require a getter method on the action. I'm guessing that you just generated the getter along with the setter.

Also, as jogep indicated, detecting the need to login would be better suited for an interceptor. This answer on Stack Overflow might help shed some light on how that works.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.