Member Avatar for ArunRaj.SRM

Hi,
I'm having my login page as:

<html><head><body>
<form action="validateuser.jsp" method="POST">
username - <input type="text" name="userName">
password - <input type="password" name="passWord">
<input type="submit" value="Submit">
<input type="reset" value="Reset">
</form></body></html>

And Validator Page as :

<%@page contentType="text/html"%>
<%@page pageEncoding="UTF-8"%>
<%@page import="java.util.*" %>
<jsp:useBean id="idHandler" class="com.suntec.tbms3.ui.Login" scope="request">
<jsp:setProperty name="idHandler" property="*"/>
</jsp:useBean>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">

<html>
<head><body>
<%
String userName = request.getParameter("userName");
String passWord = request.getParameter("passWord");
if (idHandler.authenticate(userName, passWord))
{
response.sendRedirect("welcome.jsp");
} 
else 
{
response.sendRedirect("retry.jsp");
}
%>
</body></head>
</html>

where I'm validating the username and pass word from my DB.
Now I want to display the user login name in my welcom.jsp page. what are the modification i've to do in validator.jsp and welcome.jsp

  • 4 Contributors
  • 6 Replies
  • 14K Views
  • 10 Years Discussion Span
  • Latest Post Latest Post by Vaishnav_1

Dani AI

Generated

A couple of safer, cleaner options than putting the name in the query string:

  • Forward and use a request attribute (no URL exposure). After successful authentication, set an attribute and forward. In the JSP, read it with EL rather than scriptlets.

    Validator (servlet or JSP controller):

    request.setAttribute("loginName", userName);
request.getRequestDispatcher("/welcome.jsp").forward(request, response);

    welcome.jsp:

    Welcome, ${loginName}

  • Redirect and use a session attribute (works with PRG). Store the value in the session, redirect, then read it with EL.

    Validator:

    request.getSession().setAttribute("loginName", userName);
response.sendRedirect(response.encodeRedirectURL("welcome.jsp"));

    welcome.jsp:

    Welcome, ${sessionScope.loginName}

Notes and cautions:

  • Avoid sending user data in the query string; it leaks via logs, referrers, and browser history. See OWASP’s guidance on session management and sensitive data in URLs (Session Management Cheat Sheet).
  • Keep only minimal, non-sensitive info in the session (e.g., a user id or display name), never passwords. Invalidate on logout.
  • Prefer moving authentication logic to a servlet and keeping JSPs for rendering. See the Servlet APIs for RequestDispatcher and HttpSession. If you must include values in a redirect URL, URL-encode them with URLEncoder.

Recommended Answers

All 6 Replies

Member Avatar for Thirusha

I am new to jsp but I would do either one of the following:

1. Set the username as a session variable and then in welcome.jsp u can use

<%=session.getAttribute("userName")%>

2. Send the username in the querystring when redirecting to the welcome page then just use

request.getParameter("userName")

to display it.

Member Avatar for ArunRaj.SRM

can you please little bit eloborative in the second point.
Here is my reedirect code :

response.sendRedirect("welcome.jsp?name="+userName);

then how could I able to display the value in the welcome.jsp

Member Avatar for Thirusha

If the redirect is to look like this

response.sendRedirect("welcome.jsp?name="+userName);

then to get the username from the query string you would use it just as u did earlier (from your original post "String userName = ......") , like this:

<%=request.getParameter("name")%>
Member Avatar for ArunRaj.SRM

Thank you so much. It's working fine.

Member Avatar for Ponmari

Your code works.. great work deek trisha

Member Avatar for Vaishnav_1

i didnt get the topic........ i redirected to a page and i have to diaplay user name in that page
i am unable to get hold of that trick.... can u elabrate with the complete code

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.