Designing a secure web application
Hi, I have just started out on jsp and servlet programming and currently am developing a web application for a friend of mine. I have successfully created a login form, a subscription form and a servlet to handle validation and database connections using Javabeans. I would like to get some suggestions on how to implement secure session tracking, since the database (mysql) has some sensitive information which must be viewed only by the administrator. I am using hidden fields to pass parameters and I read that this is not a good idea since these parameters can be viewed in the html source generated at the client. Can someone please explain to me which is the best to use for my sitiuation, session vars, hidden fields, url rewriting or cookies, and perhaps give me some ideas?
