Problem with Sessions in JSP

Question

Hi,
I am working on a JSP based website, where I am facing problem with sessions. The user is asked to login by providing her id and password. If found correct, a bean is created and populated with all her details and placed in session scope. I plan to use the information stored in the bean on other related pages until she logs out.
<jsp:useBean id="validUser" scope="session" class="UserBean" >
<c:set target="${validUser}" property="userId" value="${fn:trim(dbValues.UserId)}" />
<c:set target="${validUser}" property="userName" value="${fn:trim(dbValues.UserName)}" />
</jsp:useBean>
<c:redirect url="userHome.jsp" /> The user is presented her homepage - 'userHome.jsp', where she can find various links, like 'Update Profile', 'Pay Registration Fees', 'Book Room' etc. The information stored in the bean is available on 'userHome.jsp'page.
<A HREF='userHome.jsp'>Home</A>
<A HREF='editPersonal.jsp'>Update Profile</A>
<A HREF='registrationFee.jsp'>Pay Registration Fees</A>
<A HREF='bookRoom.jsp'>Book Room</A>
<A HREF='logout.jsp'>Logout</A> The problems are:
1. Whenever user clicks on any of the above mentioned links and moves to any page, the bean comes out as null.
<%-- Verify that the user is logged in --%>
<c:if test="${validUser == null}">
<jsp:forward page="loginForm.jsp">
<jsp:param name="origURL" value="${pageContext.request.requestURL}" />
<jsp:param name="errorMsg" value="You must be logged in to access this site." />
</jsp:forward>
</c:if> 2. The URL shows an additional jsessionid, which my client doesn't want to see.
3. On every click on any link, the value of this jsessionid changes.
What I presume, when I am clicking on different links, my session changes, and so I am seeing a different jsessionid. And since session is changing, therefore the bean is not available in a different session.
All this works fine with localhost, problem comes into picture, when I upload my pages to the server.
Puzzled, can anyone help, where am I going wrong? Let me add here, I am new to JSP and hence don't have much resources with me.

Answer 1

There are several ways sessions can be exchanged between the browser and the server in a j2ee web application.
1. The default is through cookies. However when the client does not accept cookies, the server appends the session id to the url.
2. Some servers also facilitate session information exchange using session id in the url even if the client does accept cookies. This is usually ahieved through a setting in some server configuration file.
You will have to find out why the server in your application is appending the session id to the url.
Whatever be the case, the server should be able to look up the session from the incoming request (be it from the session id in the url or a session cookie).
When session information is exchanged through the JSESSIONID in the url, you should ensure that each and every url that goes to the server has this input parameter. To do that all links and form post urls in your servlet/jsp should be treated with a call to encodeURL().
For example, in a jsp
   <a href = "<%=response.encodeURL("/nextJsp.jsp")%>">Click here </a>
or
   <form action = "<%=response.encodeURL("/nextJsp.jsp")%>">
   </form>etc.
ram.