0

I have a trouble with servlet coding and I don't know how to solve it. I was trying to track a session (using TomCat web server) using only hidden parameters. In this example there are name, surname and email as parameters. My idea was to ask the client just one parameter per time and send it to him as hidden parameter (iteratively).

If I start just one session (since when the client sends the first parameter to when the client sends the last parameter) my servlet works fine. The problem is when I start another session: when i send to to server the surname (a different value from the revious session) the server gives me an url where there is two times the hidden parameter "surname" with the value of the current surname and the value of the previous one's session surname.

Here is my servlet class:

    import javax.servlet.*;
    import javax.servlet.http.*;
    import java.io.*;
    import java.util.*;

    public class HiddenParamServlet extends HttpServlet {


        private final String[] PARAMS = { "name", "surname", "e-mail" }; 
        private Map<String, String> hiddenParameters;

        @Override
        public void init() {
            hiddenParameters = new HashMap<String, String>();
        }
        @Override
        public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

            response.setContentType("text/html");
            PrintWriter out = response.getWriter(); 

    // control the last parameter added by the client
            List<String> clientParameters =        Collections.list(request.getParameterNames());

    // checks if the client already sent all the parameters
            if(clientParameters.size() == 3) {
            // start the html document
                out.println("<html><head><title>Session finished</title></head>");
                out.println("<body><h1>Session succesfully completed</h1></body>");
                out.println("</html>");
            // end the html
                out.close();

                hiddenParameters.clear();
           }

           else {

              String lastParam = clientParameters.get(clientParameters.size() -1);
        //memorizing the last param sent by the client
              String value = request.getParameter(lastParam);
        hiddenParameters.put(lastParam, value);

        // starts the HTML document         
              out.println("<html>");
              out.println("<head><title>Tracking session with hidden parameters</title></head>");

              out.println("<body>");
              out.println("<form method=\"get\" action=\"/DirectoryDiSaluto/HiddenParamServlet\">");
        out.println("<p>");

        //write the next parameter to ask to the client
              out.println("<label>Insert "+PARAMS[clientParameters.size()]+":");

        // write the hidden parameters of the server
              for(String key : hiddenParameters.keySet()) {
                   out.println("<input type=\"hidden\" name=\""
            +key+"\" value=\""+hiddenParameters.get(key)+"\" />");
              }
              out.println("<input type=\"text\" name=\""+PARAMS[clientParameters.size()]+"\" />");
              out.println("<input type=\"submit\" value=\"Submit\" />");
              out.println("</label>");
              out.println("</p>");  
              out.println("</form>");
              out.println("</body>");
              out.println("</html>");
        // end the html

              out.close();
            }
         }

    }

Here is the html page where all starts:

   <html>
      <head>
          <title>Tracking session with hidden parameters</title>
      </head>

      <body>

        <form method="get" action="/DirectoryDiSaluto/HiddenParamServlet">
            <p>
            <label>Insert name:
                <input type="text" name="name"/>
                <input type="submit" value="Submit" />
            </label>
           </p>
        </form>
      </body>
   </html>

I can't understand where the problem is. Can you help me? Thanks so much!

Nivas Pandian
  • 365
  • 5
  • 14

1 Answers1

0

hiddenParameters is guilty of this behaviour, because of its bad scope. Have a look at this answer for more explanations.

Eugène Adell
  • 2,644
  • 2
  • 14
  • 30
  • Yes! The big error here was to try to memorize data on the web server using an approach that doesn't want to memorize any data neither or server or client. Thank you very much for the help! – Jenny Ficcato Mar 23 '18 at 14:32
  • You're wellcome. Yes, by design it was bad, but as an exercise it can help learning how things work, and what is a good/secure design. – Eugène Adell Mar 23 '18 at 14:51