I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea:

  1. User try to login using a form in POST method.
  2. Login success
  3. Server generate an unique session ID string and send it to the client, than create an Hashmap with KEY = session ID and value = User object.
  4. Client store the unique session ID, Username and Password using HTML 5 localStorage.
  5. On each request, client send the SessionID, username and password and the server checks if everything matches.

So, here's my question: Is this method safe?

  • 3
    Safe against what? Local storage is available to anyone using that browser on that computer. If you don't have physical safety against other people using that browser on that computer, then it is not safe.
    – jfriend00
    Commented Apr 18, 2014 at 16:09

1 Answer 1


No, this is not safe and I would certainly not recommend it. However, several methods exist that fulfill your requirements (and more).

I suggest having a look at OAuth 2.0. OAuth secured services require a valid access token in the Authorization header of HTTP requests. Such a token must first be obtained from an identity provider, usually a 3rd server.

This eliminates the need to store the user's credentials in the client application, the browser in your case. Also, tokens have a limited validity: After a set amount of time, a new access token must be presented. OAuth has a mechanism to do that, without having to request the user's credentials again: When an access token is requested, a refresh token is included in the response. The refresh token has a longer validity and can be used to obtain a new access token.

  • Thanks for the answer, I've got OAuth working on Java using Scribe. But with OAuth I could only get the Access Token, But I Can't figure out how I could use it to create a session with only server side storage. The only way I could figure is storing the token in client side and password/username in server side. Is there any other way?
    – zearthur99
    Commented Apr 19, 2014 at 0:33
  • No. The access and refresh tokens should indeed be cached in the client. The credentials are stored in the identity provider, which issues the tokens (usually a 3rd server, called the identity provider). The password should never be saved persisted in plain text, of course, but hashed with a suficciently strong hash function (e.g. SHA-2). Commented Apr 19, 2014 at 5:19

Not the answer you're looking for? Browse other questions tagged .