Session Problem

Hi all,

I dont know whats wrong and how to solve this issue. User needs to logon to access my application. Name of the user is displayed in every page he navigates. When the user logs in i fetch the user name from database using the user login ID which is saved in session variable and display the name in every page.

Sometimes this problem occurs. Say for eg. if user A logs in then his name Mr.A should be displayed in every page he navigates. For user B his name Mr.B should be displayed. But what happens is if Mr.A logs in it displays the name of some other person say Mr.D. This problem occurs sometime and i dont know what could be the cause.

It will be of great help if someone take me into right path to find the cause.

Thanks

[766 byte] By [thanua] at [2007-11-27 6:35:08]
# 1
How exactly are you saving the username in the session?
BalusCa at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 2
well i get the login id which is the employee id entered by the user and save it in a session variable. then i fetch user name corresponding to that login id from db and display it.Thanks
thanua at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 3
See that your db has unique user names and ids...on logout clearly destroy the sessions prevailed...these are the tips coming to my mind now..regardsShanu
mshanua at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 4
I wanted to know the technical details how you saved this value in session, not the functionality details. Are you using HttpSession#setAttribute() and HttpSession#getAttribute() to set and get values from session? (which is the right way).
BalusCa at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 5

yes my db has unique user names which is same as employee id. it is the primary key.

when the user clicks the link logout it takes to the logout.jsp where

i user

session.invalidate();

to invalidate the session. Is this the right method to invalidate or should i add extra piece of code to invalidate session properly. i think this is where the problem exists.

Thanks,

Thanuja.

thanua at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 6
In theory, it really doesn't matter if you invalidate the session or not. The HttpSession ought to be unique per client session.
BalusCa at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 7
yes balu iam sorry. ya i user session.setAttribute and session.getAttribute.
thanua at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 8

> yes balu iam sorry. ya i user session.setAttribute

> and session.getAttribute.

Well, then there is likely a flaw/bug somewhere in your code logic. Re-read the code, run the debugger, try to reproduce it yourself using at least two instances of an useragent.

It just sounds like that you're storing the value in the application context and/or in a static variable.

BalusCa at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 9
. The HttpSession ought to be unique per client session. -- how do i find out whether HttpSession is unique per client or not.
thanua at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 10
yes iam storing the value in the application context
thanua at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 11
Do your job and fix it.
BalusCa at 2007-7-12 18:02:05 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...