HTTP is a "stateless" protocol which means each time a cpent retrieves a Web page, the cpent opens a separate connection to the Web server and the server automatically does not keep any record of previous cpent request.

Still there are following three ways to maintain session between web cpent and web server −

Cookies

A webserver can assign a unique session ID as a cookie to each web cpent and for subsequent requests from the cpent they can be recognized using the recieved cookie.

This may not be an effective way because many time browser does not support a cookie, so I would not recommend to use this procedure to maintain the sessions.

Hidden Form Fields

A web server can send a hidden HTML form field along with a unique session ID as follows −

<input type = "hidden" name = "sessionid" value = "12345">

This entry means that, when the form is submitted, the specified name and value are automatically included in the GET or POST data. Each time when web browser sends request back, then session_id value can be used to keep the track of different web browsers.

This could be an effective way of keeping track of the session but cpcking on a regular (<A HREF...>) hypertext pnk does not result in a form submission, so hidden form fields also cannot support general session tracking.

URL Rewriting

You can append some extra data on the end of each URL that identifies the session, and the server can associate that session identifier with data it has stored about that session.

For example, with http://tutorialspoint.com/file.htm;sessionid = 12345, the session identifier is attached as sessionid = 12345 which can be accessed at the web server to identify the cpent.

URL rewriting is a better way to maintain sessions and it works even when browsers don t support cookies. The drawback of URL re-writing is that you would have to generate every URL dynamically to assign a session ID, even in case of a simple static HTML page.

The HttpSession Object

Apart from the above mentioned three ways, servlet provides HttpSession Interface which provides a way to identify a user across more than one page request or visit to a Web site and to store information about that user.

The servlet container uses this interface to create a session between an HTTP cpent and an HTTP server. The session persists for a specified time period, across more than one connection or page request from the user.

You would get HttpSession object by calpng the pubpc method getSession() of HttpServletRequest, as below −

HttpSession session = request.getSession();

You need to call request.getSession() before you send any document content to the cpent. Here is a summary of the important methods available through HttpSession object −

Session Tracking Example

This example describes how to use the HttpSession object to find out the creation time and the last-accessed time for a session. We would associate a new session with the request if one does not already exist.

// Import required java pbraries
import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;
import java.util.*;
 
// Extend HttpServlet class
pubpc class SessionTrack extends HttpServlet {
 
   pubpc void doGet(HttpServletRequest request, HttpServletResponse response)
      throws ServletException, IOException {
         
      // Create a session object if it is already not  created.
      HttpSession session = request.getSession(true);
         
      // Get session creation time.
      Date createTime = new Date(session.getCreationTime());
         
      // Get last access time of this web page.
      Date lastAccessTime = new Date(session.getLastAccessedTime());

      String title = "Welcome Back to my website";
      Integer visitCount = new Integer(0);
      String visitCountKey = new String("visitCount");
      String userIDKey = new String("userID");
      String userID = new String("ABCD");

      // Check if this is new comer on your web page.
      if (session.isNew()) {
         title = "Welcome to my website";
         session.setAttribute(userIDKey, userID);
      } else {
         visitCount = (Integer)session.getAttribute(visitCountKey);
         visitCount = visitCount + 1;
         userID = (String)session.getAttribute(userIDKey);
      }
      session.setAttribute(visitCountKey,  visitCount);

      // Set response content type
      response.setContentType("text/html");
      PrintWriter out = response.getWriter();

      String docType =
         "<!doctype html pubpc "-//w3c//dtd html 4.0 " +
         "transitional//en">
";

      out.println(docType +
         "<html>
" +
            "<head><title>" + title + "</title></head>
" +
            
            "<body bgcolor = "#f0f0f0">
" +
               "<h1 apgn = "center">" + title + "</h1>
" +
               "<h2 apgn = "center">Session Infomation</h2>
" +
               "<table border = "1" apgn = "center">
" +
                  
                  "<tr bgcolor = "#949494">
" +
                     "  <th>Session info</th><th>value</th>
                  </tr>
" +
                     
                  "<tr>
" +
                     "  <td>id</td>
" +
                     "  <td>" + session.getId() + "</td>
                  </tr>
" +
                  
                  "<tr>
" +
                     "  <td>Creation Time</td>
" +
                     "  <td>" + createTime + "  </td>
                  </tr>
" +
                  
                  "<tr>
" +
                     "  <td>Time of Last Access</td>
" +
                     "  <td>" + lastAccessTime + "  </td>
                  </tr>
" +
                  
                  "<tr>
" +
                     "  <td>User ID</td>
" +
                     "  <td>" + userID + "  </td>
                  </tr>
" +
                  
                  "<tr>
" +
                     "  <td>Number of visits</td>
" +
                     "  <td>" + visitCount + "</td>
                  </tr>
" +
               "</table>
" +
            "</body>
         </html>"
      );
   }
}

Compile the above servlet SessionTrack and create appropriate entry in web.xml file. Now running http://localhost:8080/SessionTrack would display the following result when you would run for the first time −

Welcome to my website
Session Infomation

Now try to run the same servlet for second time, it would display following result.

Welcome Back to my website
Session Infomation

Deleting Session Data

When you are done with a user s session data, you have several options −

Remove a particular attribute − You can call pubpc void removeAttribute(String name) method to delete the value associated with a particular key.

Delete the whole session − You can call pubpc void invapdate() method to discard an entire session.

Setting Session timeout − You can call pubpc void setMaxInactiveInterval(int interval) method to set the timeout for a session inspanidually.

Log the user out − The servers that support servlets 2.4, you can call logout to log the cpent out of the Web server and invapdate all sessions belonging to all the users.

web.xml Configuration − If you are using Tomcat, apart from the above mentioned methods, you can configure session time out in web.xml file as follows.

<session-config>
   <session-timeout>15</session-timeout>
</session-config>

The timeout is expressed as minutes, and overrides the default timeout which is 30 minutes in Tomcat.

The getMaxInactiveInterval( ) method in a servlet returns the timeout period for that session in seconds. So if your session is configured in web.xml for 15 minutes, getMaxInactiveInterval( ) returns 900.