Ytukyg

I have a Login Servlet where i set the attribute user logged:

protected void doPost(HttpServletRequest request, HttpServletResponse response)

                    throws ServletException, IOException 

                              ... OMITTED

    request.getSession().setAttribute("user", user_name);

    request.getRequestDispatcher("index.jsp").forward(request, response);

                              ... OMITTED

    }

From the index.jsp I go to my quit.jsp, until here i can access to the user logged through getAttribute(). But in my quit.jsp, I ask the user logged just for his password and call the Quit Servlet. The problem is that in the Quit Servlet when I try to access to the current user logged with getAttribute(), the attribute "user" is null. So my question is: how can I use a persistent attribute created in a servlet which will be used in jsp and servlets?

Your problem might not be so easy to solve. I have had a similar situation so I can give you some investigation pointers:

The cause of your null data is that when your session (where the attribute is stored) dies, times out, is re-created because the same user issues a new Login POST then your custom session data dies with it, unless you store it referenced as a session_id in a persistent storage such as a Cookie on the user browser, or a database for each user: but this can be quite complex to implement.

As a short cut:

Check out this method documentation in HttpServlet: getThreadLocalRequest().getSession(false);

and this as well which might solve your problem:

request.getSession().setMaxInactiveInterval(3600); // Max intervals in seconds between calls prior to invalidate session. This means that after one hour you will need to auto-logout your user (or force him to re-login) to prevent a null being encountered.

a logout would call:

session.removeAttribute("attribute");
session.invalidate();

Also note that you mention having 2 distinct servlets (defined in Tomcat web.xml ??). One is Login the other is Quit, they both respond to POST/GET. I suppose
they have two different implementations and I think that they do not share the same session object. So in this case you might have to implement the Login + Quit actions in the same servlet with a proper session invalidation time interval.

In a JSP file, the HttpServletRequest is available with variable name request by default. You can use it same way in the JSP file too.

So

request.getSession().setAttribute("user", user_name);

will be available in JSP file also.

<%

request.getSession().setAttribute("user", user_name);

%>