Java web application - refactor include scriptlets into a best practice approach

Question

I currently have the following includes at the top of all of my jsp files:

<%@ include file="inc/inc_cookie_login.jsp"%>
<%@ include file="inc/inc_protect_page.jsp"%>
<%@ include file="inc/inc_log_access.jsp"%>

The jsps have scriptlets that check for cookie and set a user object in the session if cookie exists, prevents access to the jsp unless a session has been set, write to a text file the User IP, name, page accessed, etc.,respectively.

The scriptlet approach above has worked fine but now that I have a better server set up and can utilize a web.xml file, I have been refactoring my app to best practices. The above is screaming FIXME! Should I be investigating listeners, filters, ?, or is my current approach adequate?

=== inc_cookie_login.jsp ====

<%@ page import="model.STKUser"%>
<%@ page import="model.STKUserCookie"%>
<%@ page import="data.STKUserDAO"%>

<%
if ( request.getSession().getAttribute("STKUserSession") == null) {
    STKUserCookie userCookie = new STKUserCookie(request);
    String userBadge = userCookie.getUserID();
    STKUserDAO userDAO = new STKUserDAO();
    STKUser user = userDAO.getUser(userBadge);
    if (user != null) {
        user.setIpAddress(request.getRemoteAddr());
        userDAO.updateLoginCount(user);
        request.getSession().setMaxInactiveInterval(36000); //set to 10 hours
        request.getSession().setAttribute("STKUserSession", user);
    }
}
%>

Rich Hill · Accepted Answer · 2010-12-09 20:21:13Z

1

This looks like a good one to be replaced by a filter. Create the filter class and ref it with a pattern in your web.xml. Scriptlets should not be used unless all other options have been reasonably exhausted.

answered Dec 9, 2010 at 20:21

Rich Hill

4632 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

jeff Over a year ago

wouldn't a listener of a new HTTP Session creation be a better choice for a cookie login? It seems over kill to keep checking if STKUserSession is null on every page access. It should be doen once per visitor, right?

Rich Hill Over a year ago

It should be once per visitor if you can guarantee that it will be there if the session is not null. You could end up with a valid session that does not contain STKUserSession depending on implementation. But in general, yeah, I'd agree that a listener on a new session could be better.

Collectives™ on Stack Overflow

Java web application - refactor include scriptlets into a best practice approach

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related