title: Setting Authorization for Java EE application
body: <p>I am doing up this application using mainly JSP and Tomcat as my server.</p>
  
  <p>I am trying to set up authorization levels whereby certain class of users can do certain stuff(access certain pages like creating new records or searching past records), eg creating new users should only be done by an admin.</p>
  
  <p>What i have done now is to first:</p>
  
  <pre><code>&lt;%
      String user = request.getParameter("name");    
      String pwd = request.getParameter("password"); 
  
      String sql = "select * from members where name = ? and password = ?";
  
      int role = 0;
  
      // since execute returns an int of 1 or 0, we can use it for our if-else statement
      if (BaseDAO.check(sql, user, pwd) != 0) {
          session.setAttribute("user", user);
          role = BaseDAO.checkRole(sql, user, pwd);
          session.setAttribute("role", role);
          response.sendRedirect("frameMgr.jsp");
      } else {
          session.setAttribute("login", 0);
          response.sendRedirect("loginPage.jsp");
      }
  %&gt;
  </code></pre>
  
  <p>After login is successful, I would then pull the value for role from the database and set it to  session attribute. Then later at my createNewUser page, i have this to check if the user is of the assigned role </p>
  
  <pre><code>&lt;% 
      int role = (Integer) session.getAttribute("role");
      // only allow people with admin role to create more accounts
      if (role != 5) {
          response.sendRedirect("frameContent.jsp"); //back to homepage
      }
  %&gt;
  </code></pre>
  
  <p>However i realised that this method is inefficient as i would have to put the check on every page and if there are changes in the future i would have to go page by page to change the code. <strong>is there a method to control all the authorization levels on one page alone? rather than having to do this on all my jsp files</strong></p>