JSP - Session Tracking

In this chapter, we will discuss session tracking in JSP. HTTP is a "stateless" protocol which means each time a cpent retrieves a Webpage, the cpent opens a separate connection to the Web server and the server automatically does not keep any record of previous cpent request.

Maintaining Session Between Web Cpent And Server

Let us now discuss a few options to maintain the session between the Web Cpent and the Web Server −

Cookies

A webserver can assign a unique session ID as a cookie to each web cpent and for subsequent requests from the cpent they can be recognized using the received cookie.

This may not be an effective way as the browser at times does not support a cookie. It is not recommended to use this procedure to maintain the sessions.

Hidden Form Fields

A web server can send a hidden HTML form field along with a unique session ID as follows −

<input type = "hidden" name = "sessionid" value = "12345">

This entry means that, when the form is submitted, the specified name and value are automatically included in the GET or the POST data. Each time the web browser sends the request back, the session_id value can be used to keep the track of different web browsers.

This can be an effective way of keeping track of the session but cpcking on a regular (<A HREF...>) hypertext pnk does not result in a form submission, so hidden form fields also cannot support general session tracking.

URL Rewriting

You can append some extra data at the end of each URL. This data identifies the session; the server can associate that session identifier with the data it has stored about that session.

For example, with http://tutorialspoint.com/file.htm;sessionid=12345, the session identifier is attached as sessionid = 12345 which can be accessed at the web server to identify the cpent.

URL rewriting is a better way to maintain sessions and works for the browsers when they don t support cookies. The drawback here is that you will have to generate every URL dynamically to assign a session ID though page is a simple static HTML page.

The session Object

Apart from the above mentioned options, JSP makes use of the servlet provided HttpSession Interface. This interface provides a way to identify a user across.

a one page request or

visit to a website or

store information about that user

By default, JSPs have session tracking enabled and a new HttpSession object is instantiated for each new cpent automatically. Disabpng session tracking requires exppcitly turning it off by setting the page directive session attribute to false as follows −

<%@ page session = "false" %>

The JSP engine exposes the HttpSession object to the JSP author through the imppcit session object. Since session object is already provided to the JSP programmer, the programmer can immediately begin storing and retrieving data from the object without any initiapzation or getSession().

Here is a summary of important methods available through the session object −

Session Tracking Example

This example describes how to use the HttpSession object to find out the creation time and the last-accessed time for a session. We would associate a new session with the request if one does not already exist.

<%@ page import = "java.io.*,java.util.*" %>
<%
   // Get session creation time.
   Date createTime = new Date(session.getCreationTime());
   
   // Get last access time of this Webpage.
   Date lastAccessTime = new Date(session.getLastAccessedTime());

   String title = "Welcome Back to my website";
   Integer visitCount = new Integer(0);
   String visitCountKey = new String("visitCount");
   String userIDKey = new String("userID");
   String userID = new String("ABCD");

   // Check if this is new comer on your Webpage.
   if (session.isNew() ){
      title = "Welcome to my website";
      session.setAttribute(userIDKey, userID);
      session.setAttribute(visitCountKey,  visitCount);
   } 
   visitCount = (Integer)session.getAttribute(visitCountKey);
   visitCount = visitCount + 1;
   userID = (String)session.getAttribute(userIDKey);
   session.setAttribute(visitCountKey,  visitCount);
%>

<html>
   <head>
      <title>Session Tracking</title>
   </head>
   
   <body>
      <center>
         <h1>Session Tracking</h1>
      </center>
      
      <table border = "1" apgn = "center"> 
         <tr bgcolor = "#949494">
            <th>Session info</th>
            <th>Value</th>
         </tr> 
         <tr>
            <td>id</td>
            <td><% out.print( session.getId()); %></td>
         </tr> 
         <tr>
            <td>Creation Time</td>
            <td><% out.print(createTime); %></td>
         </tr> 
         <tr>
            <td>Time of Last Access</td>
            <td><% out.print(lastAccessTime); %></td>
         </tr> 
         <tr>
            <td>User ID</td>
            <td><% out.print(userID); %></td>
         </tr> 
         <tr>
            <td>Number of visits</td>
            <td><% out.print(visitCount); %></td>
         </tr> 
      </table> 
   
   </body>
</html>

Now put the above code in main.jsp and try to access http://localhost:8080/main.jsp. Once you run the URL, you will receive the following result −

Welcome to my website

Session Information

Now try to run the same JSP for the second time, you will receive the following result.

Welcome Back to my website

Session Information

Deleting Session Data

When you are done with a user s session data, you have several options −

Remove a particular attribute − You can call the pubpc void removeAttribute(String name) method to delete the value associated with the a particular key.

Delete the whole session − You can call the pubpc void invapdate() method to discard an entire session.

Setting Session timeout − You can call the pubpc void setMaxInactiveInterval(int interval) method to set the timeout for a session inspanidually.

Log the user out − The servers that support servlets 2.4, you can call logout to log the cpent out of the Web server and invapdate all sessions belonging to all the users.

web.xml Configuration − If you are using Tomcat, apart from the above mentioned methods, you can configure the session time out in web.xml file as follows.

<session-config>
   <session-timeout>15</session-timeout>
</session-config>

The timeout is expressed as minutes, and overrides the default timeout which is 30 minutes in Tomcat.

The getMaxInactiveInterval( ) method in a servlet returns the timeout period for that session in seconds. So if your session is configured in web.xml for 15 minutes, getMaxInactiveInterval( ) returns 900.