java使用请求。servlet中的getSession（）将数据获取到servlet的最佳方法？

Question

我将参数传递到一个servlet以生成excel电子表格。然后我意识到这在某些情况下可能很危险。尤其是如果用户可以猜测参数并从另一家公司（在我的例子中）找到信息。然后我尝试使用@Inject来注入ViewLines sessionbean，但这似乎不起作用。然后我正在使用请求查看a post from BalusC。getSession（）方法。这很好，只需要从会话中提取我需要的对象，而无需传递它们。这是最好的方法吗

谢谢

@WebServlet(value = "/Excel")
public class ExcelServlet extends HttpServlet {

    public static int TIME_STAMP = 1;
    public static int OUNCES = 2;
    public static int REV = 3;
    public static int BENCHMARK = 4;
    public static int WORKBOOK = 0;
    @EJB
    PkgLoadService pkgLoadService;
    @EJB
    PkgLineService pkgLineService;
    private SimpleDateFormat sdf = new SimpleDateFormat("yyMMddHHmmssZ");

    @Override
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        OutputStream out = null;

        try {

            ViewLines viewLines = (ViewLines) request.getSession().getAttribute("viewLines");

            /*Date startDate = sdf.parse(request.getParameter("dateStart"));
            Date endDate = sdf.parse(request.getParameter("dateEnd"));
            PkgLine pkgLine = pkgLineService.find(Integer.parseInt(request.getParameter("pkgLineId")));
             * 
             */

            Date startDate = viewLines.getStartDate();
            Date endDate = viewLines.getEndDate();
            PkgLine pkgLine = viewLines.getSelectedPkgLine();

            response.setContentType("application/vnd.ms-excel");
            response.setHeader("Content-Disposition", "attachment; filename=" + pkgLine.getShortname() + ".xls");

            WritableWorkbook workBook = Workbook.createWorkbook(response.getOutputStream());
            WritableSheet sheet = workBook.createSheet(pkgLine.getShortname(), WORKBOOK);
            WritableCellFormat dateFormat = new WritableCellFormat(DateFormats.FORMAT9);

            WritableCellFormat ouncesOverFormat = new WritableCellFormat();
            ouncesOverFormat.setBackground(Colour.RED);

            setupCellViews(sheet);
            setupColumnLables(sheet);

            List<PkgLoad> pkgLoadList = pkgLoadService.findBetweenDates(pkgLine, startDate, endDate);

            int row = 1;

            for (PkgLoad pkgLoad : pkgLoadList) {

                sheet.addCell(new Number(0, row, row));
                sheet.addCell(new DateTime(TIME_STAMP, row, pkgLoad.getTimeStamp(), dateFormat));

                if (pkgLoad.getOunces() > pkgLoad.getWrapSpecId().getBenchmark()) {
                    sheet.addCell(new Number(OUNCES, row, pkgLoad.getOunces(), ouncesOverFormat));
                } else {
                    sheet.addCell(new Number(OUNCES, row, pkgLoad.getOunces()));
                }
                sheet.addCell(new Number(REV, row, pkgLoad.getRevolutions()));
                sheet.addCell(new Number(BENCHMARK, row, pkgLoad.getWrapSpecId().getBenchmark()));

                row++;
            }

            workBook.write();
            workBook.close();

        } catch (Exception e) {
            throw new ServletException("Exception in Excel Servlet", e);
        } finally {
            if (out != null) {
                out.close();
            }
        }
    }

Answer 1

如果只需要请求范围的对象，请使用请求。setAttribute（） 如果你把东西放在训练中，你可能会出现记忆力问题。通常，会话用于在浏览器请求之间保持对话状态。听起来你的应用不需要状态