Forward with Parameters but without using the Session

answered 2019-02-13 12:41:10 +0800

cor3000
6280 ● 2 ● 7

I am not a security expert so please check for yourself (and with your security team) whether the code below fulfills your particular requirements. It merely tries to demonstrate how the native session and request objects can be used to conditionally invalidate a session, set/check an attribute and forward the request if needed.

For this scenario I'd suggest a lower level of abstraction and work with the native HttpSession and HttpServletRequest objects directly, e.g. in a servlet filter.

This catches potential manipulation attempts at an earlier stage in the request processing (and makes you independent of the frame work used).

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import java.io.IOException;

public class CheckCertainAttributeFilter implements Filter {

    public static final String CERTAIN_SESSION_ATTRIBUTE = "certain-session-attribute";
    public static final String MY_EXPECTED_VALUE = "my-expected-value";

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
            FilterChain chain) throws IOException, ServletException {
        final HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        final HttpSession session = httpServletRequest.getSession();

        //session present, check for certain session attribute value
        if (session != null) { 
            final String certainSessionAttributeValue = 
                    (String) session.getAttribute(CERTAIN_SESSION_ATTRIBUTE);
            if (!MY_EXPECTED_VALUE.equals(certainSessionAttributeValue)) {
                session.invalidate();
                HttpSession newSession = ((HttpServletRequest) request).getSession(true);
                newSession.setAttribute(CERTAIN_SESSION_ATTRIBUTE, MY_EXPECTED_VALUE);
                request.getRequestDispatcher("/login.zul").forward(request, response);
            }
        }
        chain.doFilter(request, response);
    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException { }

    @Override
    public void destroy() { }
}

Then configure the filter in your web.xml

<filter>
    <filter-name>checkCertainAttribute</filter-name>
    <filter-class>CheckCertainAttributeFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>checkCertainAttribute</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

After that each request will be forwarded to the login.zul page, unless the expected value is present in the session attribute.