[FIXED] httpsession verification if exists

Issue

strong textI am new, need a proper way to validate. I followed

5 line code. it doent have a httpsession but still going to appointment.jsp . why so? I followed How to check if session exists or not?

it is giving a session. org.apache.catalina.session.StandardSessionFacade@3b59e880 but the user is not login in...

it does. but I dont know why and how it got one?

if (request.getSession(false) == null) {
    request.getServletContext().getRequestDispatcher("/login.jsp").forward(request, response);
} else if (request.getSession(false) != null) {
    request.getServletContext().getRequestDispatcher("/appointment.jsp").forward(request, response);
}

Solution

Session is not created after your user logs in, It is created at the first request to the container from a browser. This enables container to track subsequent requests from same browser. This is implemented usually using a cookie with unique id(session id).

So even it depends on what is happening at user logout? are you calling session.invalidate(). We cant say a user as authenticated just because session object is not null.

Answered By - Subin Sebastian