Chapter 5: Session Handling

---

Overview

In previous chapters, we noted that HTTP is the protocol most-commonly used to communicate with web applications. Unfortunately, HTTP offers no mechanism for data to be retained between requests; in other words it can't track the activities of a user across requests.

Why is this important? Well, consider the ubiquitous shopping cart application. A client using this will make several requests to the application; each request may be to add/remove a product to/from the cart, or to checkout, or so on. For the application to know what the client has bought upon checking out, it is obvious that it needs to keep track of whatever the user has selected across requests. This means not only uniquely identifying the user on each request, but probably also storing data (state) across requests and associating it with the user. Associating requests with a particular user in this way is often known as maintaining a session, and many web applications make use of sessions.

As we often need to maintain sessions, but HTTP is stateless, there are various mechanisms that have been devised to enable us to do so. These include:

• Rewriting URLs

• Creating cookies

• Using hidden form fields

In this chapter we are going to discuss these mechanisms, and consider how they can help maintain state between requests in our web applications. We will also see how we can use a selection of interfaces and classes from the Java Servlet API to create, destroy, and manipulate Java objects that represent sessions in our servlets. We will also discuss event listener interfaces that can be used to create classes that listen out for changes to the Session object.

Over the course of the chapter, we will build a web application (based upon servlets) that allows the user to create and modify notes, so that we can demonstrate the use of these interfaces and classes too.

---