Prentice Hall and Sun Microsystems. Personal use only; do not redistribute.

9.2 The Session Tracking API

201

the user has disabled them. However, it has most of the same problems as

cookies, namely, that the server side program has a lot of straightforward but

tedious processing to do. In addition, you have to be very careful that every

URL that references your site and is returned to the user (even by indirect

means like 

Location

 fields in server redirects) has the extra information

appended. And, if the user leaves the session and comes back via a bookmark

or link, the session information can be lost. 

Hidden Form Fields

HTML forms can have an entry that looks like the following: 

This entry means that, when the form is submitted, the specified name and

value are included in the 

GET

 or 

POST

 data. For details, see Section 16.9

(Hidden Fields). This hidden field can be used to store information about the

session but it has the major disadvantage that it only works if every page is

dynamically generated. 

Session Tracking in Servlets

Servlets provide an outstanding technical solution: the 

HttpSession

 API.

This high level interface is built on top of cookies or URL rewriting. In fact,

most servers use cookies if the browser supports them, but automatically

revert to URL rewriting when cookies are unsupported or explicitly disabled.

But, the servlet author doesn't need to bother with many of the details,

doesn't have to explicitly manipulate cookies or information appended to the

URL, and is automatically given a convenient place to store arbitrary objects

that are associated with each session. 

9.2 The Session Tracking API

Using sessions in servlets is straightforward and involves looking up the ses 

sion object associated with the current request, creating a new session object

when necessary, looking up information associated with a session, storing

information in a session, and discarding completed or abandoned sessions.

Finally, if you return any URLs to the clients that reference your site and

URL rewriting is being used, you need to attach the session information to

the URLs.

Second edition of this book: www.coreservlets.com; Sequel: www.moreservlets.com.

Servlet and JSP training courses by book's author: courses.coreservlets.com.