CODEWITHSUNDEEP
javagoogle-app-enginesessioncookiessession-state
antony.trupe
antony.trupe

Reputation: 10824

session id cookie in gwt rpc

Assuming I'm rolling my own session code, what's the right way to generate a unique and secure session id cookie in java.

Should I not be rolling my own but using something that's already been standardized?

I'm using gwt and the google app-engine platform.

How do I make sessions persist across browser/server restarts?

Upvotes: 8

Views: 17022

Answers (3)

antony.trupe
antony.trupe

Reputation: 10824

Using Servlet Sessions in GWT

In the remote service implementation class:

String jSessionId=this.getThreadLocalRequest().getSession().getId();

In the client code:

String jSessionId=Cookies.getCookie("JSESSIONID");

Enabling_Sessions

appengine-web.xml 

<sessions-enabled>true</sessions-enabled>

Upvotes: 24

Vineet Reynolds
Vineet Reynolds

Reputation: 76709

Ideally you should be relying on the underlying framework's session management features. Servlets & JSPs, Struts and Spring have this support, which you should use.

In the extremely rare case that you are writing your own framework with no underlying session management features to rely on, you could start with the java.security.SecureRandom class to begin with. Of course, don't reinvent the wheel here, for broken session management is the same as broken authentication.

Update

Given that you are using Google App Engine, you should rely on the session management features provided by the engine. It seems that it is not switched on by default.

Upvotes: 1

Noon Silk
Noon Silk

Reputation: 55062

No, you shouldn't be rolling your own.

The session ID needs to be cryptographically random (not guessable from known sources). It's difficult to get this right yourself.

Upvotes: 2

Related Questions