title: The Java servlet HttpSession does not seem to work immediately
body: <p>In my login servlet, the last code of <code>doPost</code> is as follows:</p>
  
  <pre><code>HttpSession session = request.getSession();
  session.setAttribute(Config.CURRENT_USER_PARAMETER, user);
  request.getRequestDispatcher("app.jsp").forward(request, response);
  </code></pre>
  
  <p>What comes to <code>app.jsp</code>, it is as follows:</p>
  
  <pre><code>&lt;%@page import="fi.vakuutustiedot.controllers.Config"%&gt;
  &lt;%@page import="fi.vakuutustiedot.model.User"%&gt;
  &lt;%@taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%&gt;
  &lt;%@page contentType="text/html" pageEncoding="UTF-8"%&gt;
  &lt;%
      if (session == null) {
          request.getRequestDispatcher("index.html").forward(request, response);
          return;
      }
  
      User user = (User) session.getAttribute(Config.CURRENT_USER_PARAMETER);
  
      if (user == null) {
          session.invalidate();
          request.getRequestDispatcher("index.html").forward(request, response);
          return;    
      }
  %&gt;
  &lt;!DOCTYPE html&gt;
  ...
  </code></pre>
  
  <p>My problem is the following scenario:</p>
  
  <ol>
  <li>I login through the HTML form that is connected to my login servlet.</li>
  <li>The login servlet creates a <code>HttpSession</code> and adds an attribute for the object describing the user in question.</li>
  <li>Finally, it forwards to <code>app.jsp</code>.</li>
  </ol>
  
  <p>The problem is that when I am logged and forwarded to <code>app.jsp</code>, I see everything I am supposed to see, <strong><em>but</em></strong> if I type <code>.../app.jsp</code> in the location bar and press Enter it redirects to <code>index.html</code>! However, when I visit <code>app.jsp</code> the second, third, .etc time, everything is fine and no spurious redirect to <code>index.html</code> happens.</p>
  
  <h1>Is this solution adequate from the security standpoint?</h1>
  
  <p>I resolved the issue by adding in the login servlet the following line:</p>
  
  <pre><code>HttpSession session = request.getSession();
  request.setAttribute(Config.CURRENT_USER_PARAMETER, user); // &lt;- The new added line.
  session.setAttribute(Config.CURRENT_USER_PARAMETER, user);
  request.getRequestDispatcher("app.jsp").forward(request, response);
  </code></pre>
  
  <p>And in <code>app.jsp</code> I have:</p>
  
  <pre><code>&lt;%@page import="fi.vakuutustiedot.controllers.Config"%&gt;
  &lt;%@page import="fi.vakuutustiedot.model.User"%&gt;
  &lt;%@page import="fi.vakuutustiedot.model.UserType"%&gt;
  &lt;%@taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%&gt;
  &lt;%@page contentType="text/html" pageEncoding="UTF-8"%&gt;
  &lt;%! User user = null; %&gt;
  &lt;%
      if (session == null) {
          request.getRequestDispatcher("no_session.html").forward(request, response);
          return;
      }
  
      user = (User) session.getAttribute(Config.CURRENT_USER_PARAMETER);
  
      if (user == null) {
          user = (User) request.getAttribute(Config.CURRENT_USER_PARAMETER);
      }
  
      if (user == null) {
          request.getRequestDispatcher("test.jsp").forward(request, response);
          return;
      }
  %&gt;
  &lt;!DOCTYPE html&gt;
  ...
  </code></pre>
  
  <h1>Answering my own question</h1>
  
  <p>In the login servlet, all I do is:</p>
  
  <pre><code>HttpSession session = request.getSession();
  session.setAttribute(Config.CURRENT_USER_PARAMETER, user);
  response.sendRedirect("app.jsp");
  </code></pre>
  
  <p>That way, the user object is available straight from the <code>session</code> and I do not need to put that user to the request object.</p>