• The enterprise bean must not attempt to pass this as an argument or method result. The
enterprise bean must pass the result of SessionContext.getEJBObject(), SessionContext.
getEJBLocalObject(), EntityContext.getEJBObject(), or
EntityContext.getEJBLocalObject() instead.
To guarantee portability of the enterprise bean’s implementation across all compliant EJB 2.0 Containers,
the Bean Provider should test the enterprise bean using a Container with the security settings
defined in Table 19. The tables define the minimal functionality that a compliant EJB Container must
provide to the enterprise bean instances at runtime.


But in waf they are passing this..

could same one comment on this?.............



package com.sun.j2ee.blueprints.waf.controller.ejb;

import com.sun.j2ee.blueprints.waf.event.*;
import javax.ejb.SessionBean;
import javax.ejb.SessionContext;

// Referenced classes of package com.sun.j2ee.blueprints.waf.controller.ejb:
// StateMachine

public class EJBClientControllerEJB
    implements SessionBean
{

    public EJBClientControllerEJB()
    {
    }

    public void ejbActivate()
    {
    }

    public void ejbCreate()
    {
        sm = new StateMachine(this, sc);
    }

    public void ejbPassivate()
    {
    }

    public void ejbRemove()
    {
        sm = null;
    }

    public EventResponse processEvent(Event event)
        throws EventException
    {
        return sm.processEvent(event);
    }

    public void setSessionContext(SessionContext sessioncontext)
    {
        sc = sessioncontext;
    }

    protected StateMachine sm;
    protected SessionContext sc;
}

Passing "this" to another EJB is a violation of the specs. Passing "this" to a Java utility object, which is private to the EJB and will never pass that data outside of the EJB, is safe.