2
\$\begingroup\$

Im using Struts2 running in google app engine.

User can use their google and facebook account to login to the site. When a user login, i have:

session.put("email", email);

When a user log-out, I have

session.remove("email");

In Struts2 Action, I have the following:

public class ChapterAction extends ActionSupport implements SessionAware{

    private static final long serialVersionUID = 1L;
    private Map<String, Object> session;

    public Map<String, Object> getSession() {
        return session;
    }
    public void setSession(Map<String, Object> session) {
        this.session = session;
    }

    public String add() throws Exception{
        String email = (String) session.get("email");
        if ( email == null)
            return LOGIN; 

        //business logic here

        return SUCCESS;
    }
}

Please critic my code. Is the above usage of session OK and secure?

Thanks

\$\endgroup\$
4
\$\begingroup\$

Code looks good, But why not move this Part:

String email = (String) session.get("email");
if ( email == null)
    return LOGIN; 

into an Interceptor? Or do you have only one relevant Action?

\$\endgroup\$
3
\$\begingroup\$

You can probably drop the getSession() method. Both OGNL and the JSP EL have mechanisms for accessing the session directly and do not require a getter method on the action. I'm guessing that you just generated the getter along with the setter.

Also, as jogep indicated, detecting the need to login would be better suited for an interceptor. This answer on Stack Overflow might help shed some light on how that works.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.