JBossWeb/Tomcat HTTP Session Implementation Details

Internal

• HTTP Session

Relevance

• JBoss AS 5.1.2

Implementation Details

Lifecycle

• Each Request maintains a direct reference to the active Session instance for that request; it can be null.
• The repository of sessions for a specific application (context) is the Template:StandardManager referred to from the Template:StandardContext via the Template:Manager reference.
• Sessions are not created automatically by the Tomcat machinery, unless we invoke Template:HttpServletRequest.getSession() (which is equivalent with Template:HttpServletRequest.getSession(true)) or Template:Org.apache.catalina.connector.Request.getSessionInternal().
• When Template:HttpServletRequest.getSession() is invoked, the following happen:
  • The Template:Manager instance is obtained from the Template:StandardContext associated with the request.
  • Template:Manager.findSession(sessionId) is messaged on the Template:Manager instance.
  • The Template:Session is looked up in the Template:Sessions map by its session ID. If found, it is returned.
  • If no session is found, and Template:Org.apache.catalina.connector.Request.SESSION ID CHECK is true, the request tries to find the session with the ID equals to requestedSessionId among the Host's children.
  • If no session is found, the Template:Manager instance is messaged to Template:CreateSession(sessionId).
  • Once the session is created by the manager (and its id generated), the request then sets a "session" cookie on Response "Set-Cookie" "JSESSIONID=FFB6...56; Path=/mycontext". The internal implementation of the cookie is Template:TomcatCookie.

!!SessionID Generation

SessionID is generated by Template:ManagerBase.generateSessionId().

!!Sesssion Counter

Maintained by the Template:SessionCounter variable of the Template:StandardManager instance of the web application.