ViralPatel.net

View Comments

• Wouldn\'t you want a \"break\" statement after line 35?

  With the current implementation it's a meaningless optimization, but if there were a number of non-session oriented pages you wouldn't want to continually do String compares when it doesn't change the result.

• Thanks Corey.
  I have updated the post and added the break statement. Certainly a break will be needed in order to skip unnecessary comparisons.

• Based on J2EE javadoc, HttpServletRequest.getSession() will always return a session object. (If the session dose not already exists, it will create a new one). I think in line 41 you need to have HttpSession session = request.getSession(false);

• Thanks Shahram for pointing out the error. I have modified the code and added HttpSession session = request.getSession(false); instead of HttpSession session = request.getSession();
  Thanks again :)

• it doesn,t works.
  I have this exception :
  java.lang.IllegalStateException: Cannot forward after response has been committed

• Hi Dod,
  Can you please paste your Filter code? The above code seems to be working for me.
  The error you are getting comes when you try to do response.sendRedirect( ) after printing something in response. You may have some out.print () statements before the redirect.

  Still I am not sure about the problem.

• that's my code:

  public void doFilter(ServletRequest req, ServletResponse res, 
   FilterChain chain) throws IOException, ServletException {
  
   HttpServletRequest request = (HttpServletRequest) req;  
   HttpServletResponse response = (HttpServletResponse) res;  
  
   String url = request.getServletPath();  
   boolean allowedRequest = false;  
  
   for(int i=0; i<totalURLS; i++) {  
    if(url.contains(urlList.get(i))) {  
     allowedRequest = true;  
     break;  
        }  
   }  
   if (!allowedRequest) {  
    RequestDispatcher disp = null;
    HttpSession session = request.getSession();  
    if (null == session) {  
    response.sendRedirect("/jsp/loginError.jsp");  
    }else{
  
     String logged = (String) session.getAttribute("logged-in");
     if (logged == null) {
      response.sendRedirect("/jsp/loginError.jsp");  
     }
    }
   }
  
   chain.doFilter(request, response);
  }
  

• Ok, so the code seems to be working

  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

  HttpServletRequest request = (HttpServletRequest) req;
  HttpServletResponse response = (HttpServletResponse) res;

  String url = request.getServletPath();
  String contextPath = request.getContextPath();
  boolean allowedRequest = false;

  for(int i=0; i<totalURLS; i++) {
  if(url.contains(urlList.get(i))) {
  allowedRequest = true;
  break;
  }
  }
  if (!allowedRequest) {
  HttpSession session = request.getSession();
  if (null == session) {
  response.sendRedirect(contextPath+"/jsp/loginError.jsp");
  }else{
  String logged = (String) session.getAttribute("logged-in");
  if (logged == null){
  response.sendRedirect(contextPath+"/jsp/loginError.jsp");
  }else{
  chain.doFilter(request, response);
  }
  }
  } else{
  chain.doFilter(request, response);
  }

  }

• Nice to see that your error got resolved :-)
  I think the code HttpSession session = request.getSession(); needs to be replaced with HttpSession session = request.getSession(false); otherwise everytime a new session will get created.

• Hi dod,

  you've got an error in line 34, please remove the semicolon.
  Additionally i get the "Cannot create a session after the response has been committed"-message, too, although i don't put anything in out?!

  Any idea?

  --------------
  public class SessionFilter implements Filter {
  private ArrayList urlList;
  private int totalURLS;

  public void destroy() {
  }

  public void doFilter(ServletRequest req, ServletResponse res,
  FilterChain chain) throws IOException, ServletException {

  HttpServletRequest request = (HttpServletRequest) req;
  HttpServletResponse response = (HttpServletResponse) res;
  String url = request.getServletPath();
  boolean noSessionNeeded = false;

  for(int i=0; i<totalURLS; i++) {
  String pattern=urlList.get(i);
  if(url.contains(pattern)) {
  noSessionNeeded = true;
  break;
  }
  }

  if (!noSessionNeeded) {
  HttpSession session = request.getSession(false);
  boolean exists=(session!=null);
  boolean isNew=session.isNew();
  if(!exists) response.sendRedirect("index.jsp");
  if(isNew) response.sendRedirect("index.jsp");
  }

  chain.doFilter(req, res);
  }

  public void init(FilterConfig config) throws ServletException {
  String urls = config.getInitParameter("noSessionNeeded");
  StringTokenizer token = new StringTokenizer(urls, ",");

  urlList = new ArrayList();

  while (token.hasMoreTokens()) {
  urlList.add(token.nextToken());

  }
  totalURLS = urlList.size();
  }
  }

• Add a return after the forward/redirect statement, this will remove the illegalArgumentException