CODEWITHSUNDEEP
javasessionjakarta-eesession-management
Cratylus
Cratylus

Reputation: 54074

Can not understand the session object behavior

I am confused on the documentation of the javax.servlet.http.HttpSession.
It says:

Sessions are used to maintain state and user identity across multiple page requests. A session can be maintained either by using cookies or by URL rewriting.

Now both cookies and URL rewriting are handled by application code in server (i.e. our code).

Then it says relating to when a session is considered as new:

The server considers a session to be new until it has been joined by the client. Until the client joins the session, the isNew method returns true.A value of true can indicate one of these three cases:
1. the client does not yet know about the session
2. the session has not yet begun
3. the client chooses not to join the session. This case will occur if the client supports only cookies and chooses to reject any cookies sent by the server. If the server supports URL rewriting, this case will not commonly occur.

I am not clear on when it is considered/meant that the client has joined the session.

I mean if I don't use cookies from my web application (or URL rewriting) and I have the following:

  1. POST from IP A to server
  2. 200 OK from server to A
  3. POST from IP A to server

In step 3 will the session.isNew() return true or false? It is not clear to me from the doc.
Will it return false (i.e. the session is not new) and I will have to call session.invalidate() in order to create a new session?
The reason this confuses me more is because I am debugging a piece of code where the client is an HTTP application but not a web brower and I see that in step 3 the session.isNew() does not return true although there is no cookies or url rewriting in the server code.
So I can not figure out what is going out under the hood.
Any info that could help understand this?

Upvotes: 1

Views: 400

Answers (1)

yatskevich
yatskevich

Reputation: 2093

Here is a nice example of Session Tracking

Client has joined the session means that client made subsequent request and included session id, which can be recognized by your webserver. If cookies are enabled - jsessionid will be passed with cookies, otherwise - it should be include in the URL itself - like this http://localhost:8080/bookstore1/cashier;jsessionid=c0o7fszeb1.

In JSP c:url from Core Tag Library will handle URL rewriting for you.

In case of B2B communication you have to obtain session id by yourself and include it in subsequent requests manually.

Example:

  1. POST from IP A to server
  2. 200 OK from server to A
  3. A obtains session id from the response
  4. POST from IP A to server and includes obtained session id

UPDATE:

Consider reading a great article - "Web Based Session Management: Best practices in managing HTTP-based client sessions." It's a general overview of how HTTP sessions can be emulated and is not tied to Java.

Upvotes: 3

Related Questions