Null HttpSession using JAAS

[bjornn]

Hi all,

I'm using JAAS in my web app with the basic authentication. It worked fine, until I write a filter.

My filter asks for "request.getSession(false) != null" and make some session attribute binds if there is a session.

I'm having problems when the filter is called at first time, just after I provide the user and password to JAAS. At this moment, the request.getSession(false) return false.

Why? When the HttpSession object will be created?
Because there is no session, my filter do not bind the atributes, and several others things that ask for the attribute don't work too.

Please help me.

Thanks.

[jaikiran]

Why are you using request.getSession(false)? Instead why not use the overloaded method request.getSession() which:

Returns the current session associated with this request, or if the request does not have a session, creates one.

Here's the API reference:

http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/servlet/http/HttpServletRequest.html#getSession()

[bjornn]

Hi jakiran,

I'm not using request.getSession() because in the case of my logout page invalidate de session, the filter would create a new one and the user would stay logged in.

[jaikiran]

"bjornn" wrote:
in the case of my logout page invalidate de session, the filter would create a new one and the user would stay logged in.

How would that happen? Your filter will be invoked before the control is forwarded to the logout page. The logout page can then use this session(created in the filter) to invoke the invalidate method.