Member Avatar for anuj_sharma

Hey Guys,
Should i use hidden textboxes or session variables to pass values between various jsp pages??

  • 4 Contributors
  • 3 Replies
  • 104 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by jwenting

Dani AI

Generated

A concise decision guide that builds on comments from , and .

Choose by scope and trust:

  • Hidden form fields: appropriate for short, single-flow form wizards. They travel with the page, are visible and tamperable, and should never hold secrets or authoritative state. Always validate any hidden-field data on the server and pair form flows with CSRF protection.
  • HttpSession (server-side): appropriate when state must be trusted across multiple requests (authentication, cart identifiers, workflow IDs). Keep session contents minimal—store IDs or small flags and rehydrate full objects from a datastore each request.
  • Cookies / URL params: useful for small, client-visible preferences or bookmarkable state; avoid sensitive values and watch size/encoding limits.
  • Persistent/shared store: for large or shared state use a central store (Redis, memcached, or DB) so sessions do not rely on single-JVM memory or expensive replication.

Operational and security checklist:

  • Regenerate session ID after authentication to prevent fixation.
  • Set cookie attributes: HttpOnly, Secure, SameSite.
  • Enforce sensible session timeouts and monitor per-session memory.
  • Validate all client-sent values server-side; use CSRF tokens for state-changing requests.
  • For high scale, avoid sticky sessions where possible; use an external session store or keep sessions minimal.

Minimal JSP pattern (store an ID, fetch server-side):

session.setAttribute("userId", userId);
Integer id = (Integer) session.getAttribute("userId");
User user = userDao.findById(id);

For hardening and detailed best practices see the OWASP guidance: Session Management Cheat Sheet and CSRF Prevention Cheat Sheet.

Recommended Answers

All 3 Replies

Member Avatar for peter_budo

Sessions as they been designed for this task

Member Avatar for Member #710122

Hey Guys,
Should i use hidden textboxes or session variables to pass values between various jsp pages??

u can use them but if u want ur code look like professional then y dont you use <jsp:include page="file_name"/> using this u can use the paramers or vairable which can be used in the other jsp to another jsp.

Member Avatar for jwenting

Normally you'd use a combination of the two, depending on what is needed.
There is even a school of thought that advocates against the use of http sessions, says that everything should be either passed through the page, through cookies, or persisted in between requests (database for example).
While that's extreme, limiting what's stored in the session can be critical in high load applications as the session does eat up server memory.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.