User Authentification & Sessions

Question

Hello all!
I started programming with sessions a day ago and now want to realize the classic login/logout webapp (if that exists :-)).
My questions is: when the user has authenticated with his user/pass, I start the session and forward him to a(ny) next page. Now, there, how do I make sure the user is logged in? Do I set an attribute in the session like auth="true"? And trust in this on the next pages? No chance to cheat? My application is not that critiocal, I'm just interested in that. How to encode urls?
Over all: how do you realize this mechanism? I like concrete code, so if someone has a good (and short and concenrated) example or a link I would be very happy.
Thanks for your help,
Henning

Answer 1

Here is a servlet I once did.
import java.io.*;
import java.util.*;
import javax.servlet.http.*;
import javax.servlet.*;
import java.sql.*;
import javax.sql.*;
public class LoginServlet extends HttpServlet {
  public void doPost (
     HttpServletRequest     request,
     HttpServletResponse     response
    ) throws ServletException, IOException
  doGet(request,response);
  public void doGet (
     HttpServletRequest     request,
     HttpServletResponse     response
    ) throws ServletException, IOException
   HttpSession session = request.getSession(true);
   PrintWriter out = response.getWriter();
     try {
          String driverName="sun.jdbc.odbc.JdbcOdbcDriver";
          String dbUrl="jdbc:odbc:login";
          Class.forName(driverName);
          Connection db =DriverManager.getConnection(dbUrl,"","");
          if ((session.getAttribute("user") == null) || (!session.getAttribute("ip").equals(request.getRemoteAddr()))){
               PreparedStatement pStmt = db.prepareStatement("SELECT * FROM [login] WHERE [account] =? AND password=? AND [activated] = 1 ");
               pStmt.setString(1, request.getParameter("account"));
               pStmt.setString(2, request.getParameter("password"));
               ResultSet rs = pStmt.executeQuery();
               if(!rs.next()){
                    System.out.println("Account is not valid.");
                    request.setAttribute("msg", "Account is not valid.");
                    RequestDispatcher rd = request.getRequestDispatcher("../login/index.jsp");
                    rd.forward(request, response);
               else do {
                    int id = rs.getInt(1);
                    String account = rs.getString(2); 
                    session.setAttribute("user", new Integer(id));
                    session.setAttribute("account", account);
                    session.setAttribute("ip", request.getRemoteAddr());
                    System.out.println("User " + session.getAttribute("user") +" has logged on.");
                    request.setAttribute("msg", "User has logged on.");
                    RequestDispatcher rd = request.getRequestDispatcher("../login/index.jsp");
                    rd.forward(request, response);
               } while(rs.next());
               rs.close();
          else {
               System.out.println("User has already logged on.");
                    request.setAttribute("msg", "User has already logged on.");
                    RequestDispatcher rd = request.getRequestDispatcher("../login/index.jsp");
                    rd.forward(request, response);
          db.close();
     catch(Exception exp){
          System.out.println("Exception: "+ exp);
   out.close();
}On all jsppages then use the following for verification:
<%
if ((session.getAttribute("user") == null) || (!session.getAttribute("ip").equals(request.getRemoteAddr()))){
response.sendRedirect("index.jsp");
%>Feel free to use.
Andreas