Home/ Questions/Q 6151001
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T19:42:18+00:00

I am writing an Android app which submits a username and password to a

  • 0

I am writing an Android app which submits a username and password to a Java Servlet hosted on Google App Engine. I am writing both the Android app. and Servlet.

The username and password are packaged into a POST request on the device and the servlet doPost() method checks the values. If the username and password are correct I request a session…creating it if it doesn’t exist:

HttpSession session = request.getSession(true);

In this session I store a name value pair “logged” and “true”.

Back on the android device a cookie is returned along with an HTTP status of 200 OK. This all seems fine, since the session on the server is implemented using cookies (transparent to me since I’m just using the session API).

All subsequent HTTP POSTs made by the android device package up the cookie into the HTTP POST so that it can request .jsp pages or use other servlets which inspect the session for the “logged and “true” value (i.e. protected pages).

The problem: A cookie is returned even if the following code is NOT run:

HttpSession session = request.getSession(true);

i.e. the username and password were false. This isn’t such a security issue since the “logged” and “true” name value pair is never set so the application cannot use the .jsp or other servlets. However, I was using the fact that a cookie had been returned from the POST request to the device as a sign that authentication was successful.

Why am I getting a cookie even though I don’t use or request the use of a session?

My current solution is to create an additional cookie in the servlet and check for this cookie on the device. HOWEVER, this cookie is not the one packaged into subsequent POSTS from the device since it is not the cookie associated with the session containing the “logged” “true” value. This seems hacky. Clearly I ave misunderstood something.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Most (or perhaps all) servlet containers will always assign a user a session cookie if they do not already have one, whether the webapp being served explicitly requests a session or not. Google App Engine is no different in this regard. You shouldn’t assume anything based upon the mere existence or non-existence of a cookie other than that the device has made a request to the server and received some response back.

    If you want to verify that the login was successful on the device, why not just send back a response to the login request that it can easily parse. For instance, a simple JSON-snippet like {"status": "success"} would do, or even just the literal text string “success”.

    Your second cookie approach definitely sounds a bit hacky. Presumably your authentication request is already sending some response back to the device (it has to be, if cookies are being sent). What do you feel that you gain from using a cookie that you don’t get by just sending some status message back as part of the response?

    • 0