J2EE authentication

[decoy]

Hi,
Just a quick question about j2ee... I have a J2EE system that
allows anybody to create their own client applications to connect
(providing access only to stateless session beans).

What would be the best way to secure this application? At the moment
when the client logs in they recieve a UserSession object, which
contains information about their connection. Whenever they then
execute a command they will send this object to the server to ensure
that they are logged in...

My question is how can I be sure that the command being recieved is
coming from the same client who logged in (and not somebody who has
created their own UserSession object with someone elses details).

I hope I made myself clear....

cheers for your help.


SAMPLE CODE:


******* ****** UserSessionHandler.java

public UserSession login(String username, String password)
{
//check the db
if(details correct)
{
UserSession session = new UserSession(username);
//set some more details....
return session;
}
else
throw new Exception("Invalid credentials");
}



********** ******* ProductSessionObject.java

public Collection getAllProducts(UserSession session)
{
if(isLoggedIn(session))
//do stuff

}

 

[patros]

When the session is first created, have the server generate a
(pseudo)random key and include it as a member variable of the
UserSession object. User passes this object back when it executes a
command, the server can verify the key. I assume you're using
encryption...