Where are the Java HttpSession attributes stored?

Question

Are the objects serialized and sent to the user and back on each connection (stored in cookies) ?

Or are they stored in the server heap and the cookie is only a very sma

Answer 1

You got it on the second guess.

The cookie contains a JSESSIONID. That id is used to look up the user's HttpSession in a map that the server maintains. At least this is the most common way. There are more intricate ways that the server can implement this, but shuttling the entire state back an forth in a cookie isn't one of them.

This has some implications. First, if the server goes down, you lose session state. Second, if you have a server cluster, you need to get the user connected to the same server each time, or they will lose their session between subsequent requests. Lastly, session hijacking becomes a possibility if someone finds a way to copy someone else's JSESSIONID and replace theirs with it.