What is session management in Java?

问题

I have faced this question in my Interview as well. I do have many confusion with Session Scope & it management in java.

In web.xml we do have the entry :

<session-config>
        <session-timeout>
            30
        </session-timeout>
</session-config>

What does it indicate actually ? Is it scope of whole project ?

Another point confusing me is how can we separate the session scope of multiple request in the same project? Means if I am logging in from a PC & at the same time I am logging in from another PC, does it differentiate it ?

Also, another confusing thing is the browser difference. Why does the different Gmails possible to open in different browsers ? And Gmail can prevent a session from Login to Logout. How is it maintained with our personal web ?

回答1:

Session management is not something limited to Java and servlets. Here's roughly how it happens:

The HTTP protocol is stateless, so the server and the browser should have a way of storing the identity of the user through multiple requests
The browsers sends the first request to the server
The server checks whether the browser has identified with the session cookie (see below)

3.1. if the server doesn't 'know' the client:
- the server creates a new unique identifier, and puts it in a Map (roughly), as a key, whose value is the newly created Session. It also sends a cookie response containing the unique identifier.
- the browser stores the session cookie (with lifetime = the lifetime of the browser instance), containing the unique identifier, and uses it for each subsequent request to identify itself uniquely.
3.2. if the server already knows the client - the server obtains the Session corresponding to the passed unique identifier found in the session cookie

Now onto some the questions you have:

the session timeout is the time to live for each session map entry without being accessed. In other words, if a client does not send a request for 30 minutes (from your example), the session map will drop this entry, and even if the client identifies itself with the unique key in the session cookie, no data will be present on the server.
different gmails (and whatever site) can be opened in different browsers because the session cookie is per-browser. I.e. each browser identifies itself uniquely by either not sending the unique session id, or by sending one the server has generated for it.
logging from different PCs is the same actually - you don't share a session id
logging-out is actually removing the entry for the session id on the server.

Note: the unique session id can alternatively be stored:

in a cookie
in the URL (http://example.com/page;JSESSIONID=435342342)
2 or 3 other ways that I don't recall and aren't of interest

回答2:

What does it indicate actually ?

The lifetime of a session. The session expires if there is no transaction between the client and the server for 30 minutes (per the code segment)

Is is scope of whole project ?

It has application scope. Defined for each web application

Another point confusing me is how can we separate the session scope of multiple request in the same project? Means if I am logging in from a PC & at the same time I am logging in from another PC, does it differentiate it ?

Yes. The session ids (JSESSIONID for Apache Tomcat) will be different.

Also, another confusing thing is the browser difference. Why does the different Gmails possible to open in different browsers ?

Each login by the same user from a different browser is a different session altogether. And the cookies set in one browser will not affect in another. So different Gmail instances are possible in different browsers.

And Gmail can prevent a session from Login to Logout. How is it maintained with our personal web ?

Persistent cookies

回答3:

Servlets in Java have an HttpSession object which you can use to store state information for a user. The session is managed on the client by a cookie (JSESSIONID) or can be done using URL rewrites. The session timeout describes how long the server will wait after the last request before deleting the state information stored in a HttpSession.

The scope is per browser instance, so in the example you give logging in from two different pcs will result in two session objects.

回答4:

if you open the same application in different window i mean multiple instance of a browser it will create different session for every instance.

回答5:

~~I recommand Apache Shiro for session management,Authentication and authorization.~~

I take it back.

As @BalusC commeneted below, only servlet container is in charge of managing the http session. Shiro is just using that. It will hook to HttpSession via a filter you explicitly define.