Copyright 2011 Sakun Sharma

Size: px

Start display at page:

Gloria Hutchinson
5 years ago
Views:

1 Maintaining Sessions in JSP We need sessions for security purpose and multiuser support. Here we are going to use sessions for security in the following manner: 1. Restrict user to open admin panel. 2. Restrict specific type of user to open some other pages. 3. Restrict user from opening pages after logging out of the console. In JSP we use session objects to do the needful. With the help of this session object, we can define variables in that session. Case Scenario: We have an application with three types of console Student, Teacher and Admin. We want that whenever any kind of member log in, that user can access only its console related pages. That user cannot open other user s pages. We also want that, when ever user log s out, that user cannot open pages by clicking back button. Solution: To solve the problem given in above case scenario, we will use session objects. To demonstrate working of this we will need 4 web pages Login, Authenticate, Welcome and Console. Login Page (login.jsp) In login page, we will ask for username and password of the user. We will create this page using simple HTML tags with Form tag. After user successfully enters its username and password, we will submit that form using POST method to Authenticate.JSP page. This page will be JSP page because we will include JSP code for session object removal. (We will discuss about session object removal in later section [Welcome Page]) Code: <?xml version="1.0" encoding="iso "?> <%@ page language="java" contenttype="text/html; charset=iso "

2 pageencoding="iso "%> taglib prefix="c" uri=" %> taglib prefix="sql" uri=" %> taglib prefix="fmt" uri=" %> taglib prefix="fn" uri=" %> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" " <html xmlns=" <head> <meta http-equiv="content-type" content="text/html; charset=iso " /> <title>sakun Sharma Blog: JSP Sessions - Login<title> <link rel="stylesheet" href="styles.css" type="text/css" /> </head> <body> <%-- Remove Session Object Variables on Log Out and New Visit--%> <% session.removeattribute("username"); session.removeattribute("type");%> <p> <font color="red"> ${fn:escapexml(param.errormsg)} </font>

3 </p> <form action="authenticate.jsp" method="post"> <table> <tr> <th colspan="2"><h4>login</h4></th> </tr> <tr> <td><center>username</center></td> <td><input type="text" name="un" id="un" value="${fn:escapexml(cookie.un.value)}"/></td> </tr> <tr> <td><center>password</center></td> <td><input type="password" name="pwd" id="pwd" value="${fn:escapexml(cookie.pwd.value)}" /></td> </tr> <tr> <td colspan="2"><center><input type="submit" name="bli" id="bli" value="enter"/></center></td> </tr>

4 </table> </form> </body> </html> Authenticate Page (authenticate.jsp) This page will be JSP page. In this page we will authenticate username and password provided by user with our database records. As we don t have database here, we will simple check username and password with static code directly defined in the page itself. But I will also include code of validating from database. After username and password has been successfully validated, we will create session object for the user. In the code given below you can see that we have defined two session variables Username and Type. Username variable contains username of user and type contains the type of user it is (Admin, Student or Teacher). In this page, we are creating session objects to be used later in welcome page for authorizing the user. Now, we have three different welcome pages Admin Welcome, Student Welcome and Teacher Welcome. Based on type of user, we will redirect user to his specific welcome page. Code: <%@ taglib prefix="c" uri=" %> <%@ taglib prefix="sql" uri=" %> <%@ page import = "java.sql.*,java.util.*" %>

5 <%-- Validation Phase--%> <c:if test="${empty param.un empty param.pwd}"> <c:redirect url="login.jsp" > <c:param name="errormsg" value="you must enter a User Name and Password." /> </c:if> <%-- See if the user name and password combination is valid from database. If not, redirect back to the login page with a message. I am commenting all the database related code because we are going to test on static code without database. Static Page Code Without Database is given at the end of this page. <sql:setdatasource datasource="jdbc/mydatasource"/> <sql:query var="stdinfo"> SELECT LT FROM LOGIN WHERE LUN =? AND LP =? <sql:param value="${param.un}" /> <sql:param value="${param.pwd}" /> </sql:query> --%> <%-- If valid username and password is given, then row count will be 1, else row count will be 0.

6 <c:if test="${stdinfo.rowcount == 0}"> <c:redirect url="login.jsp" > <c:param name="errormsg" value="the User Name or Password you entered is not valid." /> </c:if> --%> <%-- Get Type of User Field Value and store in variable LType <c:foreach var="row" items="${stdinfo.rowsbyindex}"> <c:foreach var="column" items="${row}"> <c:set var = "LType" value='${column}'/> </c:foreach> </c:foreach> --%> <%-- Setting Session Object Variables <%

7 session.setattribute("username", request.getparameter("un")); %> --%> <%-- Setting Session Object Variable Value Based on type of User Login <c:if test="${ltype == 'Teacher'}"> <%session.setattribute("type","teacher"); %> <c:redirect url="twelcome.jsp" > </c:if> <c:if test="${ltype == 'Student'}"> <%session.setattribute("type","student"); %> <c:redirect url="swelcome.jsp" > </c:if> <c:if test="${ltype == 'Admin'}"> <%session.setattribute("type","admin"); %> <c:redirect url="aconsole.jsp" >

8 </c:if> --%> <%-- Static Page Code without Database--%> <c:if test="${ param.un == admin && param.pwd == admin123., }"> <%session.setattribute("type","admin"); session.setattribute("username", request.getparameter("un")); %> <c:redirect url="awelcome.jsp" > </c:if> <c:if test="${ param.un == teacher && param.pwd == tea123., }"> <%session.setattribute("type","teacher"); session.setattribute("username", request.getparameter("un")); %> <c:redirect url="twelcome.jsp" > </c:if> <c:if test="${ param.un == student && param.pwd == stu123., }"> <%session.setattribute("type","student");

9 session.setattribute("username", request.getparameter("un")); %> <c:redirect url="swelcome.jsp" > </c:if> <%-- Default Condition--%> <c:redirect url="login.jsp" > <c:param name="errormsg" value="invalid Login Type, please contact your Administrator" /> Welcome Page In welcome page, we will check for type of user opening the page based on which welcome page is being opened. For example, if student is opening teachers welcome page, it should return error and log user out, and if it s opening student welcome page, then it should open successfully. In this page we will also have link to console page. We will use this console page to test back button security setting. (How and Why is explained in later section). Code: <?xml version="1.0" encoding="iso "?> <%@ page language="java" contenttype="text/html; charset=iso " pageencoding="iso "%>

10 page import = "java.sql.*,java.util.*" %> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" " <html xmlns=" <head> <meta http-equiv="content-type" content="text/html; charset=iso " /> <title> Sakun Sharma Blog: JSP Sessions Admin Welcome</title> <link rel="stylesheet" href="styles.css" type="text/css" /> </head> <body> <%-- Authorizing User and its type for this page.--%> <% String State = ""; if (session.getattribute("username")!=null && session.getattribute("username")!="") { State = session.getattribute("username").tostring(); if (session.getattribute("type")!= "Admin") { response.sendredirect(request.getcontextpath() + "/login.jsp?errormsg=invalid+page+requested."); }

11 } else { response.sendredirect(request.getcontextpath() + "/login.jsp?errormsg=session Closed or Session Timout."); } %> <h1>welcome Admin</h1> <br /> <h2><a href= AConsole.jsp >Admin Console</a></h2> <h2><a href= login.jsp >Log Out</a></h2> </body> </html> AConsole.jsp <?xml version="1.0" encoding="iso "?> <%@ page language="java" contenttype="text/html; charset=iso " pageencoding="iso "%> <%@ page import = "java.sql.*,java.util.*" %>

12 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" " <html xmlns=" <head> <meta http-equiv="content-type" content="text/html; charset=iso " /> <title> Sakun Sharma Blog: JSP Sessions Admin Console</title> <link rel="stylesheet" href="styles.css" type="text/css" /> </head> <body> <%-- Authorizing User and its type for this page.--%> <% String State = ""; if (session.getattribute("username")!=null && session.getattribute("username")!="") { State = session.getattribute("username").tostring(); if (session.getattribute("type")!= "Admin") { response.sendredirect(request.getcontextpath() + "/login.jsp?errormsg=invalid+page+requested."); } }

13 else { response.sendredirect(request.getcontextpath() + "/login.jsp?errormsg=session Closed or Session Timout."); } %> <h1>admin Console Page</h1> <br /> <h2><a href= AConsole.jsp >Admin Welcome Page</a></h2> <h2><a href= login.jsp >Log Out</a></h2> </body> </html> Student Welcome In student welcome page the only difference in authorizing code will be the value of type of user. Instead of: if (session.getattribute("type")!= "Admin") It will be: if (session.getattribute("type")!= "Student")

14 Similarly the code will be for student console, teacher welcome and teacher console. The method to authorize will remain same only. Removing Session Object Variables After clicking Log Out link, page will be re-directed to Login page. In login page we have added following code: Code: <%-- Remove Session Object Variables on Log Out and New Visit--%> <% session.removeattribute("username"); session.removeattribute("type");%> This code is used to remove the session objects created during the login process in authentication.jsp page. As these objects are deleted, this session will be no more valid session. Now when we will click on back link, it will open previous page successfully (not in all browsers) but will not function. It will open that page successfully because it s being opened from cache memory not from server (not applicable with all browsers), but it will not function. To test this, either re-load page by clicking refresh button or click on console.jsp link it will re-direct to login page displaying an error message Invalid Session. Default Username s and Password: Username Password Type of Login student stu123., Student Login admin admin123., Admin Login teacher tea123., Teacher Login

JSP CSCI 201 Principles of Software Development

JSP CSCI 201 Principles of Software Development Jeffrey Miller, Ph.D. jeffrey.miller@usc.edu Outline JSP Program USC CSCI 201L JSP 3-Tier Architecture Client Server Web/Application Server Database USC