TechFAQ

1. Spring Tutorial
   
2. Introduction to Spring
   
3. Benefits of Using Spring Framework
   
4. Inversion of Control in Spring
   
5. Introduction to BeanFactory
   
6. Dependency Injection in Spring
   
7. Collections Setter Injection
   
8. Bean Scopes in Spring
   
9. Spring IOC Setup Step by Step
   
10. Bean Lifecycle in Spring
    
11. ApplicationContext
    
12. MessageSources in Spring
    
13. Web Spring MVC framework
    
14. Developing Your First Spring Web Application
    
15. Developing Your Second Spring Web Application with Spring Form
    
16. Developing Your First Spring Web Application with Spring Validation Framework with Code Example
    
17. Spring integration with Hibernate
    

SCWCD : Session Management

public class CashierServlet extends HttpServlet {
	public void doGet (HttpServletRequest req, HttpServletResponse res)
			throws ServletException, IOException {

		// Get the user's session and shopping cart
		HttpSession session = request.getSession();
		ShoppingCart cart = (ShoppingCart) session.getAttribute("cart"); 
		...
		// Determine the total price of the user's books
		double total = cart.getTotal(); 
		...
	}
}
					

package javax.servlet.http;

public interface HttpSession {

	public java.lang.Object getAttribute(java.lang.String name);
	public java.util.Enumeration getAttributeNames();
	public void removeAttribute(java.lang.String name);
	public void setAttribute(java.lang.String name, java.lang.Object value);

}
					

A session is considered 'new' when it is only a prospective session and has not been established. Because HTTP is a request-response based protocol, an HTTP session is considered to be new until a client 'joins' it. A client joins a session when session tracking information has been returned to the server indicating that a session has been established. Until the client joins a session, it cannot be assumed that the next request from the client will be recognized as part of a session.

The session is considered to be 'new' if either of the following is true:

To obtain a session, use the getSession() or getSession(boolean) method of the javax.servlet.http.HttpServletRequest object. When you first obtain the HttpSession object, the one of three ways used to establish tracking of the session: cookies, URL rewriting, or Secure Sockets Layer (SSL) information. Assume the servlet container uses cookies. In such a case the servlet container creates a unique session ID and typically sends it back to the browser as a cookie. Each subsequent request from this user (at the same browser) passes the cookie containing the session ID, and the servlet container uses this ID to find the user's existing HttpSession object.

If argument in getSession(boolean) method is set to true, the HttpSession object is created if it does not already exist (the same as call of getSession() method).

If argument in getSession(boolean) method is set to false, the HttpSession object is NOT created if it does not already exist and method returns null.

You can end a session:

In the HTTP protocol, there is no explicit termination signal when a client is no longer active. This means that the only mechanism that can be used to indicate when a client is no longer active is a timeout period.

The default timeout period for sessions is defined by the servlet container and can be obtained via the int HttpSession.getMaxInactiveInterval() (sec.) method of the HttpSession interface. This timeout can be changed by the Developer using the HttpSession.setMaxInactiveInterval(int) (sec.) method of the HttpSession interface. The timeout periods used by these methods are defined in SECONDS. By definition, if the timeout period for a session is set to -1 (or ANY NEGATIVE), the session will never expire. The session invalidation will not take effect until all servlets using that session have exited the service method. Once the session invalidation is initiated, a new request must not be able to see that session.

package javax.servlet.http;

public interface HttpSession {

	public int getMaxInactiveInterval();
	public void setMaxInactiveInterval(int interval);
	public void invalidate();
	public boolean isNew();

}
					

Another way to configure session timeout (for all sessions within one web-application) is to use deployment descriptor (web.xml). The session-timeout element defines the default session timeout interval for all sessions created in this web application. The specified timeout must be expressed in a whole number of MINUTES. If the timeout is 0 or less, the container ensures the default behaviour of sessions is NEVER to time out. If this element is not specified, the container must set its default timeout period.

<web-app>
	...
	<session-config>
		<session-timeout>30</session-timeout>  <!-- 30 minutes -->
	</session-config>
</web-app>

					

Using session listeners, write code to respond to an event when an object is added to a session, and write code to respond to an event when a session object migrates from one VM to another.

Object is added to session. Listener notification.

package listeners;

import javax.servlet.http.HttpSessionAttributeListener;
import javax.servlet.http.HttpSessionBindingEvent;

public final class SessionListener implements HttpSessionAttributeListener {

	public void attributeAdded(HttpSessionBindingEvent event) {
		System.out.println("attributeAdded");
		System.out.println(event.getSession().getId());
		System.out.println(event.getName() + "', '" + event.getValue());		
	}

	public void attributeRemoved(HttpSessionBindingEvent event) {
		System.out.println("attributeRemoved");
		System.out.println(event.getSession().getId());
		System.out.println(event.getName() + "', '" + event.getValue());
    }

    public void attributeReplaced(HttpSessionBindingEvent event) {
		System.out.println("attributeReplaced");
		System.out.println(event.getSession().getId());
		System.out.println(event.getName() + "', '" + event.getValue());
    }
}
					

<web-app>
	...
	<listener>
		<listener-class>listeners.SessionListener</listener-class>
	</listener>
</web-app>

					

Object is added to session. Object notification.

package beans;

import javax.servlet.http.HttpSessionBindingListener;
import javax.servlet.http.HttpSessionBindingEvent;

public class CounterBean implements HttpSessionBindingListener {

	private int count = 1;

	public int getValue() {
		return count;
	}

	public void increment() {
		count++;
	}

	public void valueBound(HttpSessionBindingEvent event) {
		System.out.println("attributeBounded");
		System.out.println(event.getSession().getId());
		System.out.println(event.getName() + "', '" + event.getValue());		
	}

	public void valueUnbound(HttpSessionBindingEvent event) {
		System.out.println("attributeUnbounded");
		System.out.println(event.getSession().getId());
		System.out.println(event.getName() + "', '" + event.getValue());	
	}
}
					

Object migrates from one VM to another. Object notification.

package beans;

import javax.servlet.http.HttpSessionActivationListener;
import javax.servlet.http.HttpSessionEvent;

public class CounterBean implements HttpSessionActivationListener {

	private int count = 1;

	public int getValue() {
		return count;
	}

	public void increment() {
		count++;
	}

	public void sessionWillPassivate(HttpSessionEvent se) {
		System.out.println("session is about to be passivated");
		// save counter's value to persistent storage
		....
	}

	public void sessionDidActivate(HttpSessionEvent se) {
		System.out.println("session has just been activated");
		// retrieve counter's value from persistent storage
		....
	}
}
					

Given a scenario, describe which session management mechanism the Web container could employ, how cookies might be used to manage sessions, how URL rewriting might be used to manage sessions, and write servlet code to perform URL rewriting.

The following approaches are using for tracking a user's sessions:

package javax.servlet.http;

public interface HttpServletRequest extends javax.servlet.ServletRequest {
	...
	public boolean isRequestedSessionIdFromCookie();
	public boolean isRequestedSessionIdFromURL();
	public boolean isRequestedSessionIdValid();
}
					

There are 2 methods in the HttpServletResponse for URL rewriting:

package javax.servlet.http;
					
public interface HttpServletResponse extends javax.servlet.ServletResponse {

	public java.lang.String encodeURL(java.lang.String url);
	public java.lang.String encodeRedirectURL(java.lang.String url)

}
					

public void doGet(HttpServletRequest req, HttpServletResponse res)
		throws IOException, ServletException {

	response.setContentType("text/html");
	PrintWriter out = response.getWriter();
	...
	out.print("<form action='");
	out.print(response.encodeURL("SessionExample"));
	out.print("' ");
	out.println("method='post'>");
}