Question

What’s the recommended approach to intercepting session.getAttribute() and session.setAttribute()? This is in a Spring based application so something AOP-based would be great. I’d like to avoid having to override core Tomcat classes if possible.

Update: I want to store the actual serialized attributes in a web service.

Answer 1

I am not familiar with AOP or Spring (or Tomcat). 🙂 But I am familliar with Java

The way I do it is set up a filter, and replace the request variable with my own object

request = new MyRequest(request);

Then override getSession() and getSession(boolean) to return an instance of MySession

the javax.servlet.HttpServletRequest and javax.servlet.HttpSession classes are Java EE standard and not Tomcat specific.