The document discusses session management in multi-server environments, highlighting the use of session identifiers sent by clients with requests, typically stored as cookies. It explains how to remove session data and the concept of session expiration due to inactivity. Additionally, it outlines scenarios for sticky versus non-sticky sessions, emphasizing the necessity of serializing session variables in a load-balanced setup.

1. 1 H T T P S E S S I O N
M U L T I P L E S E R V E R S E N V I R O N M E N T
2 C L I E N T I D E N T I F I C A T I O N
S E S S I O N R E M O V A L
- each session is identified by sessionId
identifier and the client sends it with every
request.
- session identifier is stored on the client side
usually is stored as a cookie
- sessionId may also be encoded into URLs
- session data are stored on the server, possibly
in a server-side database if the your server
is part of a multi-server cluster
- to remove session data, use : removeAttribute() or setAttribute(null)
- to remove the whole session use: invalidate(). This basically removes all attributes and
removes the whole session from container-managed session map
- session may expire. This happens when no servlet accessed this session in configurable
amount of time (e.g. 10 minutes)
3
2 P O S S I B L E S C E N A R I O S :
- Sticky Sessions:
all your requests will be directed to the same
physical web server
- Non-sticky Sessions:
loadbalancer may choose any webserver to serve
your requests, this means the session variables
must be serialized and (usually are then) written
to a database
WEB
SECURITY
CHEAT SHEET
I N S T A N C E O F F U N C T I O N
It is basically a map from string key to some
arbitrary value.
Every time you create a session (by accessing web
page, the container will generate unique string
session ID and hold a reference to that HttpSession
object.
Once you put something in the session, the
container holds a reference to that session and the
session holds a reference to your object. It will stay
there for some time.
MynameisMarkand
I'mJavaSenior
Consultantwith+10
yearsofexperience