Storing user information into session best practice.

I am developing an web application where user first have to login to be able to enter.
When user correctly logged in an UserAccount object with all user data (except loginName and Password) is being stored into session. An Filter is checking session for UserAccount object and if user correctly logged in forwards the request to the next filter in the application.
When user logged out, the session object is being destroyed. �Session invalidate()�
I would like to know if there are better solutions for this.
Thank you in advance.
--Nermin B.

You may want to also re-evaluate your "application" as a whole.
In most cases - yours may be the exception - session objects are used to well, associate a particular web browser with a particular user. There usually is little need to retain additional information about that person, unless that information is frequently accessed. I think Shok used a poor example; a person's address, phone number, credit card number and so on is usually accessed once per visit, whereas the contents of that person's shopping cart is generally accessed every time the user changes web pages.
The key concept here is you want to balance memory consumption verses database hits (or file i/o). Authorization info should be in the object, whereas general background info can be in the data source and accessed when needed.
If on the other hand, you don't have a data source, you don't really have much of a choice and a session object (or similarly, a JavaBean) should just go ahead and contain all of the information about the user.
To change the subject, session objects and JavaBeans are server side. As long as you keep a careful eye on the interfaces to those objects, you should be fine security wise. For example, if a person passes a parameter to your web page, make sure the parameter is anticipated and correct before you save it in the object. In other words, don't write a generic function that blindly accepts parameter names and values and sets them accordingly within the session object. The only place you should be able to set the password attribute is from the change-your-password JSP page.
Cookies on the other hand are definitely stored on the client's machine, and yes, you want to be really paranoid and make sure that the cookie you are retrieving is the cookie you are expecting. I think the source of confusion is that session ids corresponding to session objects can be stored within a cookie - so you if can change the id, the server thinks you are someone else and uses that person's session object.

Similar Messages

Storing data in a session : best practice

Hi,
          We are designing a Servlet/JSP based application that has a web-tier
          separate from the middle tier.
          One of our apps have a lot of user inputs, average 500k and upto 2MB of data
          in the request.
          We do not have a way of breaking this application up (i.e the whole 2MB form
          data must be posted at ome time).
          We have 2 solutions and want to know what is the better one and wahy ...
          1. Use session and store all the information in the session.
          2. use Javascript to assemble all the data and submit it at one time.
          I prefer #2 because I don't want to use sessions and also becuase I don't
          want to use a database on the web-tier....
          Please help me explain to my cpollegues who are convinced that we have to
          use sessions to store this data..
          -JJ


Hello,
WHen you say you want to load data to other cube, which means one cube holds data for 2 yrs and another for 2 yrs....so they tend to occupy the same table space.
WHen you say summarized loading, what exactly you mean by that....???
the data is summarized in the cube ae per the char present in it....so if you reduced the no of char in the second cubes the data will get aggergated on that level giving lesser no of records and occupying less table space.
Also you can reduce the table space by just compressing the requests in the cube.
Regards,
Shashank

Importing NT User information into Portal

We are using Portal in an NT environment, and we have been able to get through the necessary single sign on issues.
Now, we need to pull our NT user information into Portal's user database, including all the groupings we already have set up so that we can take advantage of Portal's exceptional security features. This is key to our ability to use the product, and to our demo in a week.
The fact is we have 5,000 users to enter, and it is prohibitive for us to do that through the standard Portal APIs. We already have the users' input once in NT, we can get a flat file with all the information we need, we just need a way to get this information
into the appropriate tables within Portal's database.
Is there a script or some more "automated" way you can suggest for us to do this?

Maybe you could try to use an intermediate LDAP export file (ldif), since Active Directory is LDAP-based and you can plug a LDAP to your Portal SSO Login Server.
I only have tried exporting and importing using .ldif files up to now.
I also have heard about techniques to use NT user account info to log on to Portal ; 'could be easier.

Storing user Information

Hi Guys and Girls,
I am trying to store user information. I retrieve the user ID by the following code:
public String getUser() {
        FacesContext ctx = FacesContext.getCurrentInstance();
        HttpServletRequest request = (HttpServletRequest)ctx.getExternalContext().getRequest();
        //return (String)request.getAttribute("User");
        return (String)request.getSession().getAttribute("User");
    }Through out the application I will need the userId, username, email, admin status. I would like to retrieve this information once and be able to reference it. My first thought is a stateful session bean. But I am not sure if this is the best approach and I am also not sure exactly how to set the values. Do I put the above code into the bean or do I set the values in the bean from my opening jsf page. If someone could give me some direction with some code examples it would be very helpful. Thank you.

Use a session scoped managed bean.
Something like:public void login() {
    User user = UserDAO.getUser(username, password);
    if (user != null) {
        FacesContext.getCurrentInstance().getExternalContext().getSessionMap().put("user", user);
    } else {
        // Handle.
public void logout() {
    FacesContext.getCurrentInstance().getExternalContext().getSessionMap().remove("user");
}Userpublic static User getCurrentUser() {
    return (User) FacesContext.getCurrentInstance().getExternalContext().getSessionMap().get("user");
}Any beanpublic void doSomething() {
    User currentUser = User.getCurrentUser();
public void isLoggedIn() {
    return User.getCurrentUser() != null;
}faces-config:<managed-bean>
    <managed-bean-name>user</managed-bean-name>
    <managed-bean-class>mypackage.User</managed-bean-class>
    <managed-bean-scope>session</managed-bean-scope>
</managed-bean>JSF<h:outputText value="Welcome, #{user.name}" rendered="#{bean.loggedIn}" />

QoS Beta(643-642), information for "QoS best practices"

I'm preparing the "IP telephony operational specialist" exam and now for QoS beta(643-642).
Can I get an URL for "QoS Best Practices" from CCO ? And any comments for the exam.
Thanks,

Best practices differ according to the type of service your are running, here are some examples
http://www.cisco.com/en/US/tech/tk543/tk759/technologies_white_paper09186a00801348bc.shtml
http://www.cisco.com/en/US/tech/tk543/tk544/technologies_white_paper09186a008011fde2.shtml

Storing user input into a variable

Hello,
i dont know why but flash is being a pain!!
what i am doing should work as i have done pretty much as it
says from the official actionscript mx 2004 book.
Basically i am using the following code:
enter_btn.onRelease = function() {
gotoAndPlay(2);
forename = forename_txt.text;
surname = surname_txt.text;
gQuestionNum = 1;
this script is written so that when i press the enter button
the values entered into the forename_txt and surname_txt fields
should be stored in their respective variables (forename and
surname).
however when i use the following code on the next frame:
name_txt.text = forename + " " + surname;
to display the forename variable and the surname variable
into the name_txt field, it says UNDEFINED!!
what am i doiong wrong??
i know this is probably a simple thing to do but its normally
the simple thing which makes you wanna chuck your computer out the
window!!
please help if you can,
thank you and all replies will be much appreciated.
thanks again
lee

>>i dont know why but flash is being a pain!!
Because your code is wrong. You send the playhead to frame 2
before the vars are defined!!! Keep reading

Multiple database users, ORM, entity framework, best practices

Hello everyone!
You've already helped me several times, however I must ask for an advice once more.
I was assigned to develop .NET application with Data Access Layer and I've decided to use Oracle Database Software to provide sample data.
As I'm absolute novice considering creating DAL I'd be grateful if you can examine my plan in terms of security and reliability:
My database:
1) I've created database with sample tables and relations between them. All tables belongs to databaseAdmin.
2) I've created HR and Manager database users and granted them some privileges on certain databaseAdmin's tables. My intention is to reduce access to unnecessary tables. If my application user want to make some changes to Customers table it should be enough to connect to database as HR.
And now I'd like to map my database using Entity Framework in my application. And that's where I have a problem:
-If I create Entity Model basing on databaseAdmin tables I get perfect model, however every Entity SQL query would be executed on behalf of databaseAdmin, which breaks my idea of hiding unnecessary tables.
-If I create Entity Model for HR and Manager users, my models could overlap on tables that both users have access to and no connection between tables would be generated (as from their point of view those tables are just some tables that belong to databaseAdmin)
Could you help me with this deadlock? Or maybe my assumptions about multiple database users are incorrect? Please, bear in mind I'm a novice.
I was trying to find a solution in web, and there're tons of data discussing technical aspects of Entity Framework etc., but not so many documents about conceptual model of database.

hi Michael,
Thanks for you posting!
Sorry for I am not totally understanding your issue. Maybe two points need your confirm:
1. I confuse with the "Service controller"? IS your meaning MVC controller? Or ServiceController(http://www.codeproject.com/Articles/31688/Using-the-ServiceController-in-C-to-stop-and-start
2.whether The type of ID in the model is match to the database ? In other words, Is the type of IDin .edmx matched to the database?
By the way, it seems that this issue is more related to EF. You could post this issue on EF discussion for better support.
Thanks & Regards,
Will
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Printing user information into a magnetig stripe

Hi everyone,
One of our costumers wants to print their access cards directly from SAP, putting the personal data of the employee on a magnetic stripe.
Do you know if there is a list of supported printers/hardware providers that supports the direct printing from an SAP system?
Do you know if another costumers has implemented something like this? any ideas or workarounds to implement it?
Thanks in advance.
SL

Thanks for the information Darran. So you are saying I can put something like jdoe cisco123 050506 051106 group 10 and it will work? Do you think it can be done via Web?
Our goal is to allow guest access but let the tech support folks handle this. So if we can have them create an account, input expiration date and group, then we are doing good.
One has to wonder when Cisco will start working on accounts management in ACS. It is not very pleasing.
I will do this.
Thanks
Dwane

Information on OLAP best practices

Is there any limitation on creating two or more analytical workspaces in one Shema.
Thanks,
Raju.

Hi,
I must admit that I've never used the AW_COPY procedure until now. And it appears that it works completely fine to have the same name of the dimensions and cubes when you use this procedure.
However, in my testing now it seems that discoverer has a problem with the metadata generated and I get the following error: "Load OLAP API metadata" value="Unsuccessful"
When I then delete the AW using AWM I'm able to connect just fine.
I couldn't find it now, but I THINK I have stumbled upon some references to the different dimensions and cubes that was built up like this <schema>.<dimension_name>. So what I think is happening is that discoverer get several identical dimension names, gets confused, and then reports an error.
What I based my answer on yesterday was that every time I try to create a dimension with a name identical to one in another AW, I get the following errormessage:
Error Occured: Can not Create Dimension AW_DIM_TID.DIMENSION. AW Dimension with Logical Name AW_DIM_TID already Exists in Schema RAGNAR.
I'm not sure if you've had any similar problems like the ones I describe, but I would at least try to keep the names different. How this can be achieved using the AW_COPY procedure I'm afraid I don't know.
regards Ragnar

SQL server Best Practice Analyzer output in .CSV

Hi Team, I ran SQL server Best practice analyzer on our SQL 2008 R2 server. I was trying to export scan result in .csv format but it is only giving me option to save it in .xml format. I have been looking for ways to export output in such a way
that it can be readable and I can send it to our clients but no luck.
How can I export SQL BPA output in .csv or any other user friendly format?
Thanks in Advance.

Hi MSRS27,
You can run Best Practices Analyzer (BPA) scans either from Server Manager, by using the BPA GUI, or by using cmdlets in Windows PowerShell. We can view or save BPA results from Windows PowerShell session in different format.
If you want to export BPA results to a comma-separated values (CSV) text file, run the following cmdlet, where Path represents the path and text file name to which you want to save the CSV results.
CSV results can be imported into Microsoft® Excel, or other programs that display data in spreadsheets or grids.
Get-BPAResultModel ID| Export-CSVPath
For more information, see: Run Best Practices Analyzer Scans and Manage Scan Results
http://technet.microsoft.com/en-us/library/hh831400.aspx
Regards,
Sofiya Li
Sofiya Li
TechNet Community Support

Best Practice Report development

Hi All,
I am working on a blue print for a BI 7.0 project and I am searching for some information regarding a best practice for the development of queries in the three environments within SAP development/quality/production. I was wondering if there is some documentation which SAP explains the best way to use the different environments within SAP. So what are the important things to keep in consideration when building queries.
So what are the do's and which things are the absolutely dont's?
Please advise me if you know where I can find information regarding this topic..
Thanks in advance!
Kindest regards,
Jens

Hello Jens!
Just some experiences from me. Maybe they will help.
- Differ between standard reports and ad hoc reports. Standard reports are build in dev from BW-Team and transported to prod. Ad hoc reports can be build in all systems from bw power users. Standard reports should only be changeable in dev.
- Dev should only be for developers. Hold testdata in you quality-system so that users can test changes here.
Best regards,
Peter

Transaction FILE : Configuration/Usage Best Practice

Looking for information regarding the best practice configuration for the transaction FILE. In particular, the activity is currently configured as a transportable object to where we have to define values in our DEV system and then promote through to PRD. This seems a bit off. I've looked all over to try and determine if this is a default setting and to see if other folks have turned this off as a best practice but I've yet to find any relevant info. Everywhere I read about using the functionality no one ever complains about the transport process... so this leads me to beleive that it really should not be setup that way.
So, can anyone point me to a SAP Note, or White Paper, or anything, with an official recommendation on how to configure as transportable or not.
I'm not necessarily looking for opinions... I'm really looking for some hardcopy recommendations.
Thanks in advance.
Bryan

FILE is basically useful for the Logical and Physical File mapping.
The end user is not aware of any physical path.
Its difficult to remember the physical path.
Eg:
BWSWEB\Interfaces\Out\File\Bank\RBS\ is mapped to simple and easy to remember logical path like Z_Bank_RBS
The configuration is very easy and transportable.
Developer can do it if have the authorization else BASIS will do it.
YOu need to enter the logical path, physical path and the file system to configure it.
YOu can also pass the run time parameters like System ID and Client.
Eg:
BWSWEB\DE1\300 will be development and the same will be dynamically changed to
BWSWEB\QE1\300 for Quality.
Hope this helps.

Portal Design - Best Practices for Role and Workset Tab Menu

We are looking to identify and promote best practices in SAP Portal Design.
First, is there a maximum number of tabs which should exist on the highest level tab menu, commonly called the role menu? Do a large number of tabs on this menu cause performance issues? Are there any other issues associated with a large number of tabs on this menu?
Second, can the workset tab menu be customized to be 2 lines of tabs? Our goal is to prevent tab scrolling.
Thanks

Debra,
Not aware of any performance issues with the number of tabs in the Level 1 or 2 menus, particularly if you have portal navigation caching enabled.
From an end user perspective I guess "best practice" would be to avoid scrolling in the top level navigation areas completely if possible.
You can do a number of things to avoid this, including:
- Keep the role/folder/workset names as short as possible.
- If necessary break the role down into multiple level 1 entry points to reduce the number of tabs in level 2.
An example of the second point would be MSS. Instead of creating a role with a single workset (i.e. level 1 tab), we usually split it into two folders called something like "My Staff" and My Finance" and define these folders as entry points. We therefore end up with two tabs in level 1 for the MSS role, and consequently a smaller number of tabs in level 2.
Hope that helps......
Regards,
John

I18n & l10n best practices

I am looking for information on i18n best practices in large projects e.g. how to manage many resources? What tools can help with l10n? How to preserve context for easy translation? etc.
Thank you in advance,
Ze'ev

AFAIK, JILKit was always maintained by IBM, who have had a big hand in the internationalization areas of the JDK. This always made it an absolute cow to report bugs on.
I have tried, and have quite literally got the answer "What's a JILKit?" from the Sun bug guys on the other end of the database, despite the fact that I've submitted it as an I18N tool bug! :)
I would guess that Sun no longer support this, as Forte now has internationalization tools embedded within its editors. Probably a good guess that Sun will now say "Use Forte - it rocks, and we've just released Version 3". :)
I'm yet to use the Forte I18N tools, so I don't know how good they are.
To answer your conventions questions:
In the past, I have stuck with JILKit despite its bugs. As much as it likes to crash and/or rearrange your code, it has been quite efficient at finding duplicate keys and so forth. I've also kept the ResourceBundles under lock and key in CVS repositories, as I've had one accident too many with keys that go missing when more than one person is maintaining the bundles. :)
When it comes to naming the keys, I usually just stick with the English for whatever I was writing in the String in the first place. I often find that I'm more likely to remember where it came from, no matter what language it's in, that way.
I'm not quite sure what you mean by a localization toolkit. Whether that's because I've never had to come up with one, I'm not sure! :)
About the only other key thing I've found in the whole thing is the proliferation of the right fonts. I try and either ship a silver-bullet font like Arial Unicode MS, or just check for the right font, and deny the user the right to see the app in their language if it's not there.
Oh, and one last thing. Don't ever, ever, under fear of death, use MS SourceSafe for source control (that's the source control method in MS Visual Developer's Suite). It breaks so often, and causes so many problems that it's ludicrous to consider it source control. :D
Hope that helps!
Martin Hughes

How to put userinfo into session?

Hi everyone:
I have a login page.I want to put all the user information into user's session if the user logon successfully.How can I do it?
I means that if the user input the "name" and "password" is correct then put the user's address,age,registetime,city,lastname ..etc into user's session.
Thks.

Hi,
just create class(bean) User with any of these name, age... setter and getter methods and put it into session. So, during the session you will have one user in your hand.
Then you'll be able to use user.getAge() user.setAge and all that stuff and what is the most important - you will have ONE session variable.
Using beans you can make very smart application.
good luck

Storing user information into session best practice.

Similar Messages

Maybe you are looking for