HTTPSession & HTTPSessionContext

[psnambiar]

hi,

With all the knowledge i gathered from here and there about sessions - to be frank i am very confused.

1>Can someone please explain to me why and how HTTPSEssionContext is used

2> I am using about 6 servlets, where each servlet is creating a separate dynamic web page.
The first servlet is one which creates a login page. Once i create the login page, i get the id which has to be carried through the different servlets. This is easy, as i can pass query string parameter. My problem is that in between the third and the fourth servlet, i call a static html page. Once i get the static page, then i am not able to pass the id anymore. Can someone tell me how to do it?

3>The command
HttpSession sesStore = req.getSession(true);
Is this given when i create a new session. ie) in the above example, the first servlet. When the second servlet is called,
HttpSession sesStore = req.getSession(false);
i have to change the true to false, Right

A bit confused
Please throw some light

Pratibha

[Norm]

I'll try the second question.
How are you passing the session id? As part of a URL that is included in the created HTML? Then how can it get into the static HTML?
You'll have to make a servlet to replace the static HTML page so that you can insert the session id.

Norm

[dlorde]

1> Interface HttpSessionContext is deprecated, with no replacement.

2> Why not store the id information in the session object? That way each servlet can just get retrieve it from the session when it is required:request.getSession().setAttribute("UserId", new Integer(id));
...
Integer integerId = request.getSession().getAttribute("UserId");
int id = integerId.intValue();

I'm assuming it's an 'int'...

3> The HttpServletRequest.getSession(boolean) method will create a session if one doesn't already exist if you pass 'true'. If a session already exists, you will get the existing one back. If you pass 'false', it will return 'null' if a session doesn't already exist.

If you use the version that takes no argument, you get the same result as passing 'true' to the version taking a boolean. This is what I use.

Dave


To email me remove '_spamjam' from my email address

[Norm]

I have a question about your statement:
>"Why not store the id information in the session object? That way each servlet can just get retrieve it from the session when it is required"
I know of two ways to preserve Session State: Cookies and URL Rewriting(adds data in Query string). The questioner doesn't say whether his application requires cookies. If the State is being preserved by URL Rewriting, then the static HTML page will break the chain, and the Session id won't be available from a link in that page. Or am I missing something?

Norm

[dlorde]

My interpretation of the question was that it was referring to making the id information available to various servlets during a session. AFAIAA, a static HTML page encountered during the session would a create new request, but not a new session... I'm prepared to be enlightened ;-)

Dave

To email me remove '_spamjam' from my email address

[Norm]

My interpretation of his question was that he had a series of related pages. In the first one, the user logged in and an identifer for the user (a session id?) was to created and passed to future pages so that in future calls to a servlet it would know who started/owned the session. To preserve that id (save the session state), you would use either a Cookie or URL rewriting. The URL rewriting technique would fail with the static HTML page. If the session id was NOT connected to/part of the links in the static page, how would the server know what session a URL (ie <A HREF=... or Form Action=...) from that page belonged to?
I'm assuming that connections are closed after each HTTP request so they can't be used to track sessions.

Norm

[dlorde]

OIC, I was thinking about it soley from the server POV. Yes, you're quite right, without URL rewriting, a cookie would be needed so the browser can restablish the session after the static page.

Sorry, I missed the point there a bit...

Dave

To email me remove '_spamjam' from my email address