methods

32
[Q] What are the problems with container default session management > what are the alternative to solve the problem? By default container is using the cookies as a transport to carry the SessionId from server to client and from client to server. If your browser is not supporting cookies, then the cookies which contain the SessionId will not be stored in the client machine. Next when user is sending the request, this cookie will not go to server then container assumes this request as new request and creates the session object and generate SessionId again., Because of this clients old conversation will be lost. Solution: ----to solve this problem, you have to use another transport as an alternative for cookies to carry the SessionId from server to client and from client to server. You have two alternatives: ------ URL rewriting Hidden fields URL Rewriting Out.println(“<a href=’hello.jsp’>hello</a>”); Out.println(“<a href=”+res.encodeUrl(“hello.jsp”)+”>Hello</a>”); It is the lowest common denominator of session tracking . in case where a client will not accept a cookie ,URL rewriting may be used by the server to establish session tracking . URL rewriting involve adding data to the URL path that can be interpreted by container on the next request to associates the request with a session the SessionId(must be JsessionId)must be encoded as a path parameter in the resulting URL string. Example :-----http://xyz.com/hello.jsp;JSessionId=99 Hidden fields <form action=”x.sd”<br> Name<input type=”text name=”name”><br> <input type=”Hidden” name=”JSessionId”value=”<%=session.getId()%>”/> In this approach ,the unique token is embedded within each HTML form. when request is submitted ,the server receive the token as a part of request. note similar to URL rewriting the hidden parameter . since each request should include a form submission .so ,it may not be applicable to all type of pages. The server specification doesn’t use this approach. Difference version of getsession() :-------- getsession() getsession(Boolean) getsession() Use this version in any case. if you want session.i.e. whether session is already present or not getsession(Boolean) Use this version if you want the session only when session is already available .

Upload: phani

Post on 17-Aug-2015

218 views

Category:

Documents


3 download

DESCRIPTION

Methods

TRANSCRIPT

[Q]What are the problems withcontainer default session management > what are the alternativeto solve the problem?By default container is using the cookies as a transport to carry the SessionId from server to client and fromclient to server.If your browser is not supporting cookies, then the cookies which contain the SessionId will not be stored inthe client machine. Next when user is sending the request, this cookie will not go to server then containerassumes this request as new request and creates the session obect and generate SessionId again., Because ofthis clients old conversation will be lost. Solution: ----to solve this problem, you have to use another transport as an alternative for cookies to carry theSessionId from server to client and from client to server.!ou have two alternatives" ######$%& rewriting'idden fieldsU! ewriting(ut.println)*+a href,-hello.sp-.hello+/a.012(ut.println)*+a href,03res.encode$rl)*hello.sp0130.'ello+/a.012It is the lowest common denominator of session tracking . in case where a client will not accept a cookie ,$%&rewriting may be used by the server to establish session tracking . $%& rewriting involve adding data to the$%& path that can be interpreted by container on the next request to associates the request with a session theSessionId)must be 4sessionId1must be encoded as a path parameter in the resulting $%& string.5xample "#####http"//xy6.com/hello.sp24SessionId,77"idden fields +form action,0x.sd0+br.Name+input type,0text name,0name0.+br.+input type,0'idden0 name,04SessionId0value,0+8,session.getId)18.0/.Inthisapproach,theuniquetokenisembeddedwithineach'9:& form. whenrequestissubmitted,theserver receive the token as a part of request. note similar to $%& rewriting the hidden parameter . since eachrequest should include a form submission .so ,it may not be applicable to all type of pages.9he server specification doesn-t use this approach.#ifference version of getsession$% "######## getsession)1 getsession)Boolean1getsession$%$se this versionin any case. if you want session.i.e.whether session is already present or not getSession)1getSession)true1;if)session obect is available1;return it2