title: JSP storing password in session
body: <p>This issue has been waked up a lot of times i know, but here's unclear moments for me. </p>
  
  <p>I using JSP with Hibernate and i want to implement user's authentification trough database's functinality - <code>create user ...</code> - and login with same approach.
  So every my script should know the login and password of current user and the only way i know to do it with sessions like:</p>
  
  <pre><code>SessionFactory sf = new Configuration()
         .configure("/hibernate.cfg.xml")
         .setProperty("hibernate.connection.username", session.getAttribute("username"))
         .setProperty("hibernate.connection.password", session.getAttribute("password"))
         .buildSessionFactory();
  </code></pre>
  
  <p>Is it seems vulnerable? Why should i avoid the pass storage in session if it executes on server side?</p>