Session in Struts2 and Google App Engine

Question

Im using Struts2 running in google app engine.

User can use their google and facebook account to login to the site. When a user login, i have:

session.put("email", email);

When a user log-out, I have

session.remove("email");

In Struts2 Action, I have the following:

public class ChapterAction extends ActionSupport implements SessionAware{

    private static final long serialVersionUID = 1L;
    private Map<String, Object> session;

    public Map<String, Object> getSession() {
        return session;
    }
    public void setSession(Map<String, Object> session) {
        this.session = session;
    }

    public String add() throws Exception{
        String email = (String) session.get("email");
        if ( email == null)
            return LOGIN; 

        //business logic here

        return SUCCESS;
    }
}

Please critic my code. Is the above usage of session OK and secure?

Thanks

Answer 1

Code looks good, But why not move this Part:

String email = (String) session.get("email");
if ( email == null)
    return LOGIN; 

into an Interceptor? Or do you have only one relevant Action?

Answer 2

You can probably drop the getSession() method. Both OGNL and the JSP EL have mechanisms for accessing the session directly and do not require a getter method on the action. I'm guessing that you just generated the getter along with the setter.

Also, as jogep indicated, detecting the need to login would be better suited for an interceptor. This answer on Stack Overflow might help shed some light on how that works.