2

I have a jsp where I set a session variable.

<% session.setAttribute("user", CrossSession.getUser(token)); %>

But when I try to read the session variable "user" within another jsp - which got loaded in an iframe (same host, server, etc.) - then I just get NullPointerException

<%= session.getAttribute("user").toString() %>

How can I get my session variables in iframes?

BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
KIC
  • 5,887
  • 7
  • 58
  • 98

2 Answers2

1

Some browsers are quite restrictive as to sharing cookies with the iframe, particularly Safari. One way of bypassing this is to explicitly pass the session ID as path parameter of iframe's URL, hereby making use of "URL rewriting" support of the average servlet container as to session management (Tomcat supports it by default out the box).

<iframe src="some.jsp;jsessionid=${pageContext.session.id}" ...>

Note that I still assume that you're honest in saying that the iframe is served form the same host/domain.

BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
0

When you imbed a html framgment in an <iframe> element, you are strictelly instructing the server to fire a new HTTP request, thus you will have an independent response within another context that won't include your session object. That's why you are receiving a NPE, because session is null.

But since all your jsp pages are within the same server, you can have the session object passed across another embeded jsp but when using the <jsp:include /> directive.

So rather than embeding the jsp inside an iframe, embed the jsp like follows:

<jsp:include page="page_name.jsp" />
tmarwen
  • 15,750
  • 5
  • 43
  • 62
  • thanks! sadly this is not a solution for me because my iframe is created and controlled by javascript. – KIC Aug 21 '14 at 08:33