request.setAttribute() visibility

[pr0n603]

This might seem like a really stupid question....

Is the data transfered through HttpServletRequest.setAttribute(String, Object) and HttpServletRequest.getAttribute(String) visible to traffic outside the web server. Meaning, are these objects transfered through URL rewritting/cookies or are they just within the java application. Basically, can i pass sensitivy data through these methods w/o compromising security?

My guess is yes....any opinions?

Thanks!

 

[sedj]

Any data contained within the HttpSession object is purely on the server, and never transmitted to the client. The only thing relating betweeen the HttpSession object and the client is the JSESSIONID cookie, which links the server based HttpSession object, and the particular browser this relates to - not any data - just the id, if you like.

Click here to learn Ways to help with Tsunami Relief
--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk

 

[pr0n603]

Im talking about HttpServletRequest not HttpSession

 

[sedj]

Its the same principle.

Click here to learn Ways to help with Tsunami Relief
--------------------------------------------------
Free Database Connection Pooling Software

http://www.primrose.org.uk