I am working on a servlet application, obviously there are two options to store data such as User's ID, one is through cookies and another through sessions, I felt more comfortable with sessions because I feel that it will be under my control thus eliminating the risk of someone reading browser's cookies and steal of modify some information.Now that this decision was made to use session rather than coockies, I was also thinking of the possibility of one servlet session gets a different session data by mistake, I realize that this should not happen, but this just came to mind as a possibility, so I was wondering if such incident was reported before or some of the users have experienced it somehow. I have not found such reports about this, so i thought I should be the first to bring this up.The reason this represents a major concern for me is that a lot of the backend logic depends on the user's ID, and since I am planning to avoid the overhead of going into the MySQL database and get the ID every time i need it, i thought the best way is to get the ID directly from the session.getattribute(user_id); which i set every time the user logs in, therefore it will have a very bad impact if for some reason the Java application gets different session information such as ID and perform an operation for a different user that is not intended to be performed. Thoughts?
How reliable is a servlet's session data storage in terms of integrity?
java;web development;networking;data integrity;servlet