jsp 對(duì)request.getSession(false)的理解(附程序員常疏忽的一個(gè)漏洞)
更新時(shí)間:2009年07月01日 01:41:44 作者:
在網(wǎng)上經(jīng)??吹接腥藢?duì)request.getSession(false)提出疑問(wèn),我第一次也很迷惑,看了一下J2EE1.3 API,看一下官網(wǎng)是怎么解釋的。
【前面的話】
在網(wǎng)上經(jīng)??吹接腥藢?duì)request.getSession(false)提出疑問(wèn),我第一次也很迷惑,看了一下J2EE1.3 API,看一下官網(wǎng)是怎么解釋的。
【官方解釋】
getSession
public HttpSession getSession(boolean create)
Returns the current HttpSession associated with this request or, if if there is no current session and create is true, returns a new session.
If create is false and the request has no valid HttpSession, this method returns null.
To make sure the session is properly maintained, you must call this method before the response is committed. If the container is using cookies to maintain session integrity and is asked to create a new session when the response is committed, an IllegalStateException is thrown.
Parameters: true - to create a new session for this request if necessary; false to return null if there's no current session
Returns: the HttpSession associated with this request or null if create is false and the request has no valid session
譯:
getSession(boolean create)意思是返回當(dāng)前reqeust中的HttpSession ,如果當(dāng)前reqeust中的HttpSession 為null,當(dāng)create為true,就創(chuàng)建一個(gè)新的Session,否則返回null;
簡(jiǎn)而言之:
HttpServletRequest.getSession(ture) 等同于 HttpServletRequest.getSession()
HttpServletRequest.getSession(false) 等同于 如果當(dāng)前Session沒(méi)有就為null;
【問(wèn)題和bug】:
我周圍很多同事是這樣寫的;
HttpSession session = request.getSession(); // a new session created if no session exists, 哈哈!完蛋啦!如果session不存在的話你又創(chuàng)建了一個(gè)!
String user_name = session.getAttribute("user_name");
需要注意的地方是request.getSession() 等同于 request.getSession(true),除非我們確認(rèn)session一定存在或者sesson不存在時(shí)明確有創(chuàng)建session的需要,否則盡量使用request.getSession(false)。在使用request.getSession()函數(shù),通常在action中檢查是否有某個(gè)變量/標(biāo)記存放在session中。這個(gè)場(chǎng)景中可能出現(xiàn)沒(méi)有session存在的情況,正常的判斷應(yīng)該是這樣:
HttpSession session = request.getSession(false);
if (session != null) {
String user_name = session.getAttribute("user_name");
}
【投機(jī)取巧】:
如果項(xiàng)目中用到了Spring(其實(shí)只要是Java的稍大的項(xiàng)目,Spring是一個(gè)很好的選擇),對(duì)session的操作就方便多了。如果需要在Session中取值,可以用WebUtils工具(org.springframework.web.util.WebUtils)的getSessionAttribute(HttpServletRequest request, String name)方法,看看高手寫的源碼吧:哈哈。。
/**
* Check the given request for a session attribute of the given name.
* Returns null if there is no session or if the session has no such attribute.
* Does not create a new session if none has existed before!
* @param request current HTTP request
* @param name the name of the session attribute
* @return the value of the session attribute, or <code>null</code> if not found
*/
public static Object getSessionAttribute(HttpServletRequest request, String name) {
Assert.notNull(request, "Request must not be null");
HttpSession session = request.getSession(false);
return (session != null ? session.getAttribute(name) : null);
}
注:Assert是Spring工具包中的一個(gè)工具,用來(lái)判斷一些驗(yàn)證操作,本例中用來(lái)判斷reqeust是否為空,若為空就拋異常。
上面的代碼又可以簡(jiǎn)潔一下啦,看吧:
HttpSession session = request.getSession(false);
String user_name = WebUtils.getSessionAttribute(reqeust, "user_name");
來(lái)源:http://blog.csdn.net/xxd851116
在網(wǎng)上經(jīng)??吹接腥藢?duì)request.getSession(false)提出疑問(wèn),我第一次也很迷惑,看了一下J2EE1.3 API,看一下官網(wǎng)是怎么解釋的。
【官方解釋】
getSession
public HttpSession getSession(boolean create)
Returns the current HttpSession associated with this request or, if if there is no current session and create is true, returns a new session.
If create is false and the request has no valid HttpSession, this method returns null.
To make sure the session is properly maintained, you must call this method before the response is committed. If the container is using cookies to maintain session integrity and is asked to create a new session when the response is committed, an IllegalStateException is thrown.
Parameters: true - to create a new session for this request if necessary; false to return null if there's no current session
Returns: the HttpSession associated with this request or null if create is false and the request has no valid session
譯:
getSession(boolean create)意思是返回當(dāng)前reqeust中的HttpSession ,如果當(dāng)前reqeust中的HttpSession 為null,當(dāng)create為true,就創(chuàng)建一個(gè)新的Session,否則返回null;
簡(jiǎn)而言之:
HttpServletRequest.getSession(ture) 等同于 HttpServletRequest.getSession()
HttpServletRequest.getSession(false) 等同于 如果當(dāng)前Session沒(méi)有就為null;
【問(wèn)題和bug】:
我周圍很多同事是這樣寫的;
復(fù)制代碼 代碼如下:
HttpSession session = request.getSession(); // a new session created if no session exists, 哈哈!完蛋啦!如果session不存在的話你又創(chuàng)建了一個(gè)!
String user_name = session.getAttribute("user_name");
需要注意的地方是request.getSession() 等同于 request.getSession(true),除非我們確認(rèn)session一定存在或者sesson不存在時(shí)明確有創(chuàng)建session的需要,否則盡量使用request.getSession(false)。在使用request.getSession()函數(shù),通常在action中檢查是否有某個(gè)變量/標(biāo)記存放在session中。這個(gè)場(chǎng)景中可能出現(xiàn)沒(méi)有session存在的情況,正常的判斷應(yīng)該是這樣:
復(fù)制代碼 代碼如下:
HttpSession session = request.getSession(false);
if (session != null) {
String user_name = session.getAttribute("user_name");
}
【投機(jī)取巧】:
如果項(xiàng)目中用到了Spring(其實(shí)只要是Java的稍大的項(xiàng)目,Spring是一個(gè)很好的選擇),對(duì)session的操作就方便多了。如果需要在Session中取值,可以用WebUtils工具(org.springframework.web.util.WebUtils)的getSessionAttribute(HttpServletRequest request, String name)方法,看看高手寫的源碼吧:哈哈。。
復(fù)制代碼 代碼如下:
/**
* Check the given request for a session attribute of the given name.
* Returns null if there is no session or if the session has no such attribute.
* Does not create a new session if none has existed before!
* @param request current HTTP request
* @param name the name of the session attribute
* @return the value of the session attribute, or <code>null</code> if not found
*/
public static Object getSessionAttribute(HttpServletRequest request, String name) {
Assert.notNull(request, "Request must not be null");
HttpSession session = request.getSession(false);
return (session != null ? session.getAttribute(name) : null);
}
注:Assert是Spring工具包中的一個(gè)工具,用來(lái)判斷一些驗(yàn)證操作,本例中用來(lái)判斷reqeust是否為空,若為空就拋異常。
上面的代碼又可以簡(jiǎn)潔一下啦,看吧:
復(fù)制代碼 代碼如下:
HttpSession session = request.getSession(false);
String user_name = WebUtils.getSessionAttribute(reqeust, "user_name");
來(lái)源:http://blog.csdn.net/xxd851116
相關(guān)文章
jsp實(shí)現(xiàn)checkbox的ajax傳值實(shí)例
這篇文章主要介紹了jsp實(shí)現(xiàn)checkbox的ajax傳值,實(shí)例分析了針對(duì)checkbox的Ajax使用技巧,具有一定參考借鑒價(jià)值,需要的朋友可以參考下2015-02-02JSP Spring 自動(dòng)化裝配Bean實(shí)例詳解
這篇文章主要介紹了JSP Spring 自動(dòng)化裝配Bean實(shí)例詳解的相關(guān)資料,需要的朋友可以參考下2017-04-04jsp登陸校驗(yàn)演示 servlet、login、success
這篇文章主要為大家詳細(xì)介紹了jsp登陸校驗(yàn)演示,具有一定的參考價(jià)值,感興趣的小伙伴們可以參考一下2016-12-12用連接池提高Servlet訪問(wèn)數(shù)據(jù)庫(kù)的效率(1)
用連接池提高Servlet訪問(wèn)數(shù)據(jù)庫(kù)的效率(1)...2006-10-10jsp+servlet實(shí)現(xiàn)文件上傳與下載功能
這篇文章主要為大家詳細(xì)介紹了jsp+servlet實(shí)現(xiàn)文件上傳與下載功能,具有一定的參考價(jià)值,感興趣的小伙伴們可以參考一下2017-12-12response.getWriter().write()向前臺(tái)打印信息亂碼問(wèn)題解決
本節(jié)主要介紹了response.getWriter().write()向前臺(tái)打印信息亂碼問(wèn)題解決方法,需要的朋友可以參考下2014-08-08