More About Servlets Session Tracking Jan 13 2019 Persistent information A server site typically needs to maintain two kinds of persistent remembered information Information about the session A session starts when the user logs in or otherwise identifies himself herself and continues until the user logs out or completes the transaction for example makes a purchase Information about the user User information must generally be maintained much longer than session information for example remembering a purchase This information must be stored on the server for example on a file or in a database Server capabilities Servlets like Applets can be trusted or untrusted A servlet can use a unique ID to store and retrieve information about a given session User information usually requires a login ID and a password Since servlets don t quit between requests any servlet can maintain information in its internal data structures as long as the server keeps running A trusted servlet can read and write files on the server hence can maintain information about sessions and users even when the server is stopped and restarted An untrusted servlet will lose all information when the servlet or server stops for any reason This is sometimes good enough for session information This is almost never good enough for user information Session tracking HTTP is stateless When it gets a page request it has no memory of any previous requests from the same client This makes it difficult to hold a conversation Typical example Putting things one at a time into a shopping cart then checking out each page request must somehow be associated with previous requests The server must be able to keep track of multiple conversations with multiple users Session tracking is keeping track of what has gone before in this particular conversation Since HTTP is stateless it does not do this for you You have to do it yourself in your servlets Session tracking solutions Cookies are small files that the servlet can store on the client computer and retrieve later URL rewriting You can append a unique ID after the URL to identify the user Hidden form fields can be used to store a unique ID Java s Session Tracking API can be used to do most of the work for you Hidden form fields input type hidden name sessionID value Advantage Disadvantages Requires the least knowledge All you need to know is how to read and write parameters Not kept across sessions so useless for maintaining persistent information about a user Since the session ID must be incorporated into every HTML page every HTML page must be dynamically generated There s not much more to say about using hidden form fields since you should already know enough to do it Cookies A cookie is a small bit of text sent to the client that can be read again later Limitations for the protection of the client Not more than 4KB per cookie more than enough in general Not more than 20 cookies per site Not more than 300 cookies total Cookies are not a security threat Cookies can be a privacy threat Cookies can be used to customize advertisements Outlook Express allows cookies to be embedded in email A servlet can read your cookies Incompetent companies might keep your credit card info in a cookie Netscape lets you refuse cookies to sites other than that to which you connected Using cookies import javax servlet http Constructor Cookie String name String value Assuming request is an HttpServletRequest and response is an HttpServletResponse response addCookie cookie Cookie cookies request getCookies String name cookies i getName String value cookies i getValue There are of course many more methods in the HttpServletRequest HttpServletResponse and Cookie classes in the javax servlet http package Some more Cookie methods public void setComment String purpose public String getComment public void setMaxAge int expiry public int getMaxAge Max age in seconds after which cookie will expire If expiry is negative delete when browser exits If expiry is zero delete cookie immediately setSecure boolean flag public boolean getSecure Indicates to the browser whether the cookie should only be sent using a secure protocol such as HTTPS or SSL More HttpServletRequest methods public HttpSession getSession public Enumeration getHeaderNames Given the header name return its value public int getIntHeader String name Gets an Enumeration of all the field names in the HTTP header public String getHeader String name Gets the session object for this request or creates one if necessary Given the header name return its value as an int Returns 1 if no such header Could throw a NumberFormatException public Enumeration getHeaders String name Given the header name return an Enumeration of all its values The Session Tracking API The session tracking API is in javax servlet http HttpSession and is built on top of cookies To use the session tracking API Create a session Store information in the session and retrieve it as needed HttpSession session request getSession Returns the session associated with this request If there was no associated session one is created session setAttribute name value Object obj getAttribute name Session information is automatically maintained across requests Summary A session is a continuous interaction with the user HTTP is stateless so the programmer must do something to remember session information There are multiple ways to remember session information The session ends when the user quits the browser or a session may be set to time out Some information must be kept longer than just within a session For example if the user orders a product that information must be kept in a database Long term storage of information requires that the servlet have some additional privileges The End
View Full Document
Unlocking...