Question

I have an email system and I am looking to add an attachment feature. My issue, is after the user uploads their attachment file to my server I want to link the filename to their session somehow.
So they click upload, a popup comes up prompting them to browse for the file and upload, when the process is done (file is now on my server and popup closes). I want to somehow show the user the attachment that will be sent with the email (just the filename).

Would I do this in a database or in a cookie.
Basically linking the session id with a filename(s) of the attachments.

I am currently thinking of doing this in a cookie. I am not sure how safe that is. Or this is open to any exploits

Answer 1

no, you should not do that in a cookie. The session is there for this reason. To be able to link any session objects to the session.

To add the file name on the session just do:

session.setAttribute("filename", filename);

and get it using:

String filename = session.getAttribute("filename").toString();

You can even add hole Objects in the session without facing any problems.