Best way to check if a user has access to a database recourse

[an...@claire.co.jp]

Hi

I have an application where the users have a number of messages in a 
database.  Each user can only look at their own messages.  What is the 
best way about ensuring a user cannot have access
to anothers email.  Ie, if I have a scheme like

/displayMessages.do?user=tony&messageStart=20&messageEnd=40      -(1)

what is to stop someone else coming along, who has successfully logged 
on who is not user tony and and just typing (1) in and accessing these 
messages. I realise that I can have a check in the displayMessages.do 
action which will do something like

if ( (Current user as indicated by the session) ==
      (The user as specified in the http request))

And then if this condition is true then tomcat will deliver the 
messages, otherwise an error screen is presented.
But I am not sure if this is (the best)/(a good) way.  I want to hear 
how other people handle this situation.  Please tell me how you handle this.

Thank you

Tony



--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>