Servlet Session Tracking

Servlet Session Tracking PowerPoint PPT Presentation

  • Uploaded on
  • Presentation posted in: General

2. Persistent information. A server site typically needs to maintain two kinds of persistent (remembered) information:Information about the sessionA session starts when the user logs in or otherwise identifies himself/herself, and continues until the user logs out or completes the transaction (for

Download Presentation

Servlet Session Tracking

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript

1. Servlet Session Tracking

2. 2 Persistent information A server site typically needs to maintain two kinds of persistent (remembered) information: Information about the session A session starts when the user logs in or otherwise identifies himself/herself, and continues until the user logs out or completes the transaction (for example, makes a purchase) Information about the user User information must generally be maintained much longer than session information (for example, remembering a purchase) This information must be stored on the server, for example on a file or in a database

3. 3 Server capabilities Servlets, like Applets, can be trusted or untrusted A servlet can use a unique ID to store and retrieve information about a given session User information usually requires a login ID and a password Since servlets don’t quit between requests, any servlet can maintain information in its internal data structures, as long as the server keeps running A trusted servlet can read and write files on the server, hence can maintain information about sessions and users even when the server is stopped and restarted An untrusted servlet will lose all information when the servlet or server stops for any reason This is sometimes good enough for session information This is almost never good enough for user information

4. 4 Session tracking HTTP is stateless: When it gets a page request, it has no memory of any previous requests from the same client This makes it difficult to hold a “conversation” Typical example: Putting things one at a time into a shopping cart, then checking out--each page request must somehow be associated with previous requests The server must be able to keep track of multiple conversations with multiple users Session tracking is keeping track of what has gone before in this particular conversation Since HTTP is stateless, it does not do this for you You have to do it yourself, in your servlets You can do this by maintaining a session ID for each user

5. 5 Session tracking solutions Hidden <form> fields can be used to store a unique ID for the session Cookies are small files that the servlet can store on the client computer, and retrieve later URL rewriting: You can append a unique ID after the URL to identify the user Java’s Session Tracking API can be used to do most of the work for you

6. 6 Hidden <form> fields <input type="hidden" name="sessionID" value="..."> Advantages: All you need to know is how to read servlet parameters String sessionID = getParameter("sessionID"); out.println("<input type=\"hidden\" name=\"sessionID\" value=\" + sessionID + "\">"); Efficient: Minimizes repeated calls to the server Disadvantages: Information is lost when browser quits or goes to another page Useless for maintaining persistent information about a user Can be spoofed Since the session ID must be incorporated into every HTML page, every HTML page must be dynamically generated Hidden fields are good for session tracking (holding a “conversation” with the user)--they’re simple and efficient

7. 7 Using hidden <form> fields, I The very first request that the user sends you will (typically) have null for the value of your hidden field When your servlet sees the null, it can assign a unique session ID and include it in a hidden field in the response Each subsequent request will include this hidden field The servlet can keep session information in some data structure of its own, keyed by the session ID This is feasible because the servlet does not quit between requests, so it can maintain information in its memory You cannot assume the user will end the session the way you think she should (say, by logging off) If the session data is sufficiently “old,” you need to assume the user isn’t coming back, and discard the session data

8. 8 Using hidden <form> fields, II The session ID does not have to be the only hidden field You can have other fields in addition to, or instead of, a session ID field This might be a good way to keep track of small amounts of simple information during a session Hidden fields are not particularly well suited to holding complex or structured information In all cases, hidden <form> fields are good only for storing session information Information in servlet data structures will eventually be lost (when the servlet quits) or get old and be discarded

9. 9 Cookies A cookie is a small bit of text sent to the client that can be read again later Limitations (for the protection of the client): Not more than 4KB per cookie (more than enough in general) Not more than 20 cookies per site Not more than 300 cookies total Cookies are not a security threat Cookies can be a privacy threat Cookies can be used to customize advertisements Outlook Express allows cookies to be embedded in email A servlet can read your cookies Incompetent companies might keep your credit card info in a cookie Netscape and Firefox let you refuse cookies to sites other than that to which you connected

10. 10 Using cookies import javax.servlet.http.*; Constructor: Cookie(String name, String value) Assuming request is an HttpServletRequest and response is an HttpServletResponse, response.addCookie(cookie); Cookie[ ] cookies = request.getCookies(); String name = cookies[i].getName(); String value = cookies[i].getValue(); There are, of course, many more methods in the HttpServletRequest, HttpServletResponse, and Cookie classes in the javax.servlet.http package

  • Login