Servlet Session Tracking API

Internal

• HTTP Session

Overview

The servlet API provides facilities that help the developer to track the servlet's session. Servlets have built-in session tracking. The level of support, however, depends on the web server. Most servers support session tracking through the use of persistent cookies, and when the client doesn't accept cookies, the servers could revert to URL rewriting.

JBossWeb and Tomcat manage HTTP sessions for web applications.

Establishing a Session

To ensure that a session is properly maintained, the getSession() method must be called at least once before committing the response. Sessions are not created automatically, unless we invoke HttpServletRequest.getSession(), which is equivalent with HttpServletRequest.getSession(true).

Both unauthenticated users and authenticated users can maintain sessions.

When a user first accesses a web application, that user is assigned a new Template:Javax.servlet.http.HttpSession object and a unique session ID. The session ID identifies the user and it is used to match the user with Template:HttpSession object in subsequent requests. Template:HttpSession provides a way to identify a user across more than one page request or visit to a Web site and to store information about that user. The servlet container uses this interface to create a session between an HTTP client and an HTTP server. The session persists for a specified time period, across more than one connection or page request from the user. A session usually corresponds to one user, who may visit a site many times.

Behind the scenes, the session ID is usually saved on the client in a cookie called JSESSIONID. For clients that don't support cookies, the session ID can be sent as part of a rewritten URL, encoded using a Template:Jsessionid parameter, e.g. Template:Http://server.com/servlet/MyServlet ;jsessionid=123 ?item=1234. Other implementations using SSL are also possible.

The programmer can get the Template:HttpSession associated with an user from inside the servlet using Template:GetSession() method.

The programmer then can save any set of arbitrary Java objects in a session object (the only limitation is that the saved objects must be Template:Serializable). To add data to the session, use Template:Public void HttpSession.setAttribute(String name, Object value). To retrieve data from a session use Template:Public Object HttpSession.getAttribute(String name).