1

How do application servers keep track of which client is associated with which HttpSession object? Is it related to keeping track of the TCP/IP connection between the client? Or cookies perhaps? I doubt it's cookies since there is a separate method for extracting cookies.

Background

I understand that servlets and JSPs can call request.getSession() to obtain an HttpSession object associated with a client. I'm curious as to how the server knows to return that same object when the client requests new pages. I've searched around and all documentation I find is on how to extract session information. I'm interested in how the server isolated that session information from the sea of client data it has access to.

Usman Mutawakil
  • 4,993
  • 9
  • 43
  • 80
  • 2
    Related: http://stackoverflow.com/questions/3106452/how-do-servlets-work-instantiation-session-variables-and-multithreading/3106909#3106909 – BalusC Sep 02 '12 at 19:36

1 Answers1

8

I doubt it's cookies

It is! There are essentially two ways of keeping track of user session in stateless HTTP protocol and servlets: JSESSIONID cookie or URL rewriting. The latter is used when cookies are not available.

With first response servlet container sets the following cookie in the client:

Set-Cookie: JSESSIONID=25E7A6C27095CA1F560BCB2983BED17C; Path=/; HttpOnly

Every subsequent request includes this cookie, and servlet container uses it to provide correct HttpSession. You can access this cookie directly using servlet API, you can even build your own session mechanism on top of JSESSIONID or some other cookie. But the servlet container does that for you.

See also

Community
  • 1
  • 1
Tomasz Nurkiewicz
  • 334,321
  • 69
  • 703
  • 674
  • Is URL rewriting something you enable that can be added to all your URLs or do you need to manually append it and parse it from the requests? I've never used wicket but if I understand correctly, it's handling the URL rewriting? – Usman Mutawakil Sep 02 '12 at 19:34
  • 2
    A self-respected MVC framework would offer a tag for this. JSF for example offers `` for this. In "plain vanilla JSP", you'd need JSTL's `` for this. – BalusC Sep 02 '12 at 19:37