Take the 2-minute tour ×

I use the Struts2 framework. In jsp, I show a login box in my project and when the user clicks on a login button, I set a cookie with the name "loggedin" and set its value to "true" in an Action Class.

Then returning "success" will load this login page again.

In login page:

Cookie cookie[] = request.getCookies();
for( c : cookie )
 if( c.getName().equals("loggedin") )
  if( !c.getValue().equals("true") )

//show login form here.


  }//end inner if

  else //if cookie "loggedin" value is "true"


//show username/profile picture/logout button here

  }//end else
 }//end outer if
}/end for loop

I got a problem. When I this click login button in the login form, a cookie is set and the page is reloaded. But instead of a username/profile picture, the login form is still being displayed until I reload the page manually.

  1. How can I solve this?
  2. I think it's not the correct way to check logged in or not. Can somebody please tell me how to check this in another way?
share|improve this question
You might consider actively logging other user sessions out as opposed to logging in. It is difficult to track log-in information but setting a "last logged in" and a hash that the cookie matches for authentication is one "easy" approach. –  Daniel B. Chapman Apr 4 '13 at 1:20
This is wrong on multiple levels. The easiest is to set a session value to something (like, say, a User object) to indicated there's a logged in user, then simply check for the presence of that value. USING JSTL, NOT SCRIPTLETS. –  Dave Newton Apr 4 '13 at 2:34
Or Struts2 Tags and OGNL, instead of JSTL :) –  Andrea Ligios Apr 4 '13 at 9:35

2 Answers 2

up vote 6 down vote accepted

Please ! Please ! Do not use scriptlets. They are hard to maintain and every developer loathes them.

There are many ways to track sessions.

  • Using cookies
  • URL Rewriting
  • Hidden params

These are well documented around the web. The fastest way to generate a session is to execute HttpSession session = request.getSession(true);. You can proceed to attach session information to this object once it has been created.

Take a look at a JSTL primer and rants on why scriptlets are bad.

share|improve this answer

Using scriptlets in jsp is never-ever recommended. Why are you not using struts tags or JSTL tags. Use session to set a session attribute upon each successful login and check for session and that particular attribute for checking against user login. Like:

//on successfull login...
Session session=request.getSession(true);
session.setAttribute("id",id); //here in place of id you can use something related to user, that can uniquely identify to each user.

// now to check for user logged in or not

Session session=request.getSession(false);
// by providing false value it will try to access a session already available, but it won't create a new session.
//now you can check like this..
    // do your stuffs here.........

  // you can send the control to login page or to somewhere else as your requirement.



// send the control to login page because session object is null...

And one most important thing, don't write all these logics in your jsp's. Jsp is supposed to put view logic only. In struts put all business/main logic in Action class.

share|improve this answer
+1, but no needs to getSession(false) and then check if the session is null... take a session, if it's new, the attribute won't be there, so the check will work the same (and in your case you should double your else part, to send the control to a login page even when the session is null, not only when is valid but the user is not logged in) –  Andrea Ligios Apr 4 '13 at 9:37
@AndreaLigios : Actually sometimes I am using as you explained but I never focused on the difference in a way like you described. I got it. Thank you for nice suggestion. –  Shailesh Saxena Apr 4 '13 at 9:45
@Andrea Ligios: Please don't mind. while thinking as your point of view I have a query. If at some point, we create a new session each time for checking a user's session unnecessarily it will give the burden on server as each time it will create a session object on server side on per user/client/browser. As best of my knowledge either we'll need to invalidate the session each time or it will be destroyed when browser is closed or being time out. Please let me know if I am wrong or provide your kind suggestion. –  Shailesh Saxena Apr 12 '13 at 6:35
Sorry, I don't understand :/ –  Andrea Ligios Apr 12 '13 at 7:57

Your Answer


