Filters not working properly - servlets

Question

I made two filters for my auction web application. I implemented two filters, the first which performs simple logging operations, and the second, which check if the user is authorized to access a particular resource.
The troubles is that These filters work correctly only the first time I connect to the website. Infact it displays the name of the the user in the toolbar, and this happens only if you logged in correctly. Afterwards, I log out and I repeat the process, but the second filter does not work at all.
I put println statements to check if the filters are actually executed, but it isn't the case. The first filter works constantly. The strange part arises when I change the xml mapping. Infact, when I take the mapping out for both filters, the first filter continues working! I went nuts all day yesterday trying to understand this.
Weirder yet, If I rewrite the xml mapping for the filters, they work both for the first log in process, but then, once I log out and repeat the operation, the log in filter doesnt work anymore. To make my web application I am just JAVA7, netbeans 7.2 and Tomcat 7. I fear that this may be a bug with the Netbeans IDEA, but I am not sure.
The xml mapping is the following:
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
<filter>
<filter-name>FiltroLoggingFumettopoli</filter-name>
<filter-class>Filtri.FiltroLoggingFumettopoli</filter-class>
</filter>
<filter-mapping>
<filter-name>FiltroLoggingFumettopoli</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<filter>
<filter-name>FiltroLogin</filter-name>
<filter-class>Filtri.FiltroLogin</filter-class>
</filter>
<filter-mapping>
<filter-name>FiltroLogin</filter-name>
<url-pattern>/Registrato/*</url-pattern>
<servlet-name>IlMioConto</servlet-name>
<servlet-name>Vendi</servlet-name>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>**
Here is the first filter which does the logging in the log fil:
private void doBeforeProcessing(ServletRequest request, ServletResponse response)
throws IOException, ServletException {
if (debug) {
log("FiltroLoggingFumettopoli:DoBeforeProcessing");
}
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
this.log(httpRequest.getRemoteHost()+" is trying to access page: "+httpRequest.getRequestURL()+
" il "+TimeUtility.ottieniDataOra()+". "+filterConfig.getFilterName());
System.out.println("FILTRO FILE DI LOG----> LOGGING OCCURED IN LOG FILE: "
+httpRequest.getRequestURL()+" il "+TimeUtility.ottieniDataOra()+". "+filterConfig.getFilterName());
}
private void doAfterProcessing(ServletRequest request, ServletResponse response)
throws IOException, ServletException {
if (debug) {
log("FiltroLoggingFumettopoli:DoAfterProcessing");
}
}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain)
throws IOException, ServletException {
doBeforeProcessing(request, response);
Throwable problem = null;
try {
chain.doFilter(request, response);
} catch (Throwable t) {
problem = t;
t.printStackTrace();
}
doAfterProcessing(request, response);
if (problem != null) {
if (problem instanceof ServletException) {
throw (ServletException) problem;
}
if (problem instanceof IOException) {
throw (IOException) problem;
}
sendProcessingError(problem, response);
}
}
here is the filter which checks if it is an authorized user who wants access to the resources that are contained in the Registrato folder, and a few servlets:
public class FiltroLogin implements Filter
{
private FilterConfig filterConfig = null;
public void init(FilterConfig filterConfig)
{
this.filterConfig = filterConfig;
}
public void doFilter(ServletRequest request,ServletResponse response,
FilterChain chain) throws IOException, ServletException
{
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
HttpSession sessione = httpRequest.getSession();
ServletContext sc = filterConfig.getServletContext();
String filterName = filterConfig.getFilterName();
String servletPath = "Servlet path: " + httpRequest.getServletPath();
String url ="";
Utente user = null;
user = (Utente) sessione.getAttribute("utente");
if(user == null){
Cookie[] cookies =httpRequest.getCookies();
String email = CookieUtility.ottieniValoreCookie(cookies, "userCookie");
if(email.equalsIgnoreCase("")){
System.out.println("FILTRO LOGIN----->NESSUN COOKIE TROVATO!");
System.out.println("FILTRO LOGIN----->SERVLET CONTEXT: "+sc.getContextPath());
url ="/MostraInserzioni";
httpResponse.sendRedirect(sc.getContextPath()+url);
return;
}
else{
System.out.println("FILTRO LOGIN----->COOKIE TROVATO: "+email);
user = UtenteSql.cercaUtente(email);
System.out.println("FILTRO LOGIN----->UTENTE TROVATO: "+user.getUsername());
sessione.setAttribute("utente", user);
String salutoUtente = "Benvenuto "+user.getNome();
sessione.setAttribute("messaggio", salutoUtente);
}
}
else
System.out.println("FILTRO LOGIN----->USER FOUND: "+user.getUsername());
sc.log(httpRequest.getRemoteHost()+" cerca di accedere alla risorsa: "+httpRequest.getRequestURL()+
" il "+TimeUtility.ottieniDataOra()+". "+filterConfig.getFilterName());
System.out.println("FILTRO FILE DI LOG----> LOGGING OCCURED IN LOG FILE: "
+httpRequest.getRequestURL()+" il "+TimeUtility.ottieniDataOra()+". "+filterConfig.getFilterName());
chain.doFilter(request, response);
}
public void destroy()
{
filterConfig = null;
}
}

Answer 1

Simply user = sessione == null ? null : (Utente) sessione.getAttribute("utente"); and after else { just: sessione = httpRequest.getSession(true); Prevents holding sessions for non-users. – Joop Eggen yesterday
HttpSession sessione = httpRequest.getSession(false);
if (sessione == null) {
System.out.println("FILTRO LOGIN----->USER NOT FOUND IN SESSION!");
– Salvatore Servodio 44 mins ago
Then I checked the cookies. If I find the cookie i need i simply create a new session and put the USER info in the session , otherwise i simply redirect to the login page