Problem with Sessions in Servlets

Question

Hi,
I'm having a problem with sesions with servlets. It seems that if someone logs into my website, which is running on all servlets, while another person is logged on, the second person gets the session of the first person.
I'm using
HttpSession session = request.getSession(true);to get the session in each page. The session contains a user object which shows if the user is logged in and what permissions.
The session should be unique to the client computer right? Or am I jsut screwing this up big time?

Answer 1

Yes, each client will have their own session. However, you may be testing incorrectly:
In Firefox, for example, all instances of the application running on the same machine will share the same cookies, therefore the same session, and would be considered one client.
MS IE will do the same if you use File - New to open a new wondow rather than clicking on the desktop icon.
If the different clients are using different machines and still getting shared data, then you may be using class-level variables in the servlet, which would not be thread safe and could lead to your problems...
public class MyServlet extends HttpServlet {
  String data;  //bad
  int moredata; //bad
  public void doGet(...) ... { ... }
}