Keep a session variable after login which is set before user login

[Abutalib Shaikh, modifié il y a 7 années.]

Hello everyone ,
I need to keep session variable after and before login within all portlets
I have following scenario.
1. when user select option from navigation portlet and set selected option variable value in session
which is accessible in all portlets
code : PortletSession session = request.getPortletSession();
session.setAttribute("select_option","ABC",PortletSession.APPLICATION_SCOPE);

and trying to access after user login by using below code :
<%
PortletSession pre=renderRequest.getPortletSession();
String product_name = (String)pre.getAttribute("select_option ", PortletSession.APPLICATION_SCOPE);
%>

and put entry in liferay-portlet.xml entry in both portlets :
<private-session-attributes>false</private-session-attributes>

but i am getting product_name=NULL after login
-seems Session is changed after login that's why we can't access session variable after login which is set before login.

- so please suggest me any way to achieve this requirement ?

thank you

[Samuel Kong, modifié il y a 7 années.]

You can set the follow property to 'false'. However, please be aware that there is a security risk with making this change. Consider your environment carefully before making the change.

    #
    # Set this to true to invalidate the session when a user logs into the
    # portal. This helps prevent phishing. Set this to false if you need the
    # guest user and the authenticated user to have the same session.
    #
    session.enable.phishing.protection=true

[Abutalib Shaikh, modifié il y a 7 années.]

Thank's , Samuel

its working For me i am able to access session variable after login but ,
when click on logout getting same issue can't access session variable value in portlet after logout

i am not aware explain me what are the security ricks with this change .
can you please explain me the same ?

[Sandeep Nair, modifié il y a 7 années.]

Why would you ever want to do that? When you logout, session is invalidated and new session is started. Obviously you would not get whatever you have stored in session. The whole meaning of having a session is so that servlet container uniquely identifies a user and storing something between login and logout.

[Samuel Kong, modifié il y a 7 années.]

Please see https://www.owasp.org/index.php/Session_fixation

[Samuel Kong, modifié il y a 7 années.]

when click on logout getting same issue can't access session variable value in portlet after logout

This isn't supported and you shouldn't even try to make this work. Huge security issues with this.

[Abutalib Shaikh, modifié il y a 7 années.]

Thank's , Samuel
for make very clear what are the security reasons , so
i am not going with session concept.

but ,

could you please suggest another way to achieve my requirement .
Requirement :
- i have one navigation (docbar same for all pages) which contains product list like "abc","xyz" etc
- when user select any product from navigation i want to maintain selected product value in whole website doesn't matters user logged in or not
- because my all page (portlets) content depends on selected "product".

- could you please help me for the same . .