In layman's seesion and cookies

Sessions are referred to as "session control" in computers, especially in network applications. The Session object stores the properties and configuration information required for a specific user session. Session tracking is a common technique used in Web programs to keep track of a user's entire session. Common session tracking techniques are cookies and sessions. The cookie determines the user's identity by logging information on the client, and the session determines the user's identity by logging information on the server side. Today, this blog post, the small part of the main simple introduction of the session and cookies, but also please the great God to teach you a lot.

The fundamentals of the session
Small partners know that the cookie is a client, the session is stored on the server, if the session is stored in the entire space, as long as the user does not close the browser, can get the set value from the servers, if you restart the browser is not, Seesion is a session, A session can be thought of as a person, then she is bound to this person, corresponding to the browser, so the person and browser are bound, such as:

Combined with the above graphics, small to detailed introduction, if Zhang San is a person, and Zhang three is a client, Zhang three to access our server (currently we use the server is Tomcat), when Zhang Sanlai access, we open a resource on Tomcat or to open a space for Zhang San, More precisely, is to allocate a piece of memory to Zhang San, OK, this time, Zhang San can be accessed, Zhang San can be stored in memory resources, as long as the browser does not close the operation, the resources Zhang San can be stored at any time, regardless of the number of pages visited, As long as the resources previously stored in this browser, Zhang San can be taken out, but if the operation of the browser is closed, then the inside of the things Zhang San will not be able to get out, open the browser again, with Zhang San to log in, is not taken out, so this piece of content occupies the memory. Then if this time John Doe come, John Doe also opened a space, John Doe the browser off, the same, John Doe this piece also occupies a certain amount of memory, explained here, small part believe that the small partners can understand, Seesion really serve the end, on Tomcat, the cookie is on the client, We are in a bit of research, HTTP this protocol, small partners have some understanding, such as our usual use of communication tools QQ, she can detect the other side in the line, such as Zhang San sent a message to John Doe, John Doe reply to the Zhang San message, then the question came, Zhang San how to find John Doe it? Zhang San must know John Doe address, so Zhang San and John Doe can find each other, and the HTTP protocol is what? Or the above example, assuming that Zhang San to visit, Access Tomcat,tomcat opened up a space for it, then response to return, the next time the visit, Zhang San how to know where he needs to find? Instead of looking for other places? Because there is a lot of space, assuming that there are 10,000 users, there are 10,000 memory allocations, how to know where to access the memory allocated to the Zhang San? Can I mark it with a Zhang San? What if there are duplicates? What should we do? So the HTTP protocol is no state, she will not be in the state of connection, if it has been connected to the state, Zhang San will certainly find the memory allocated to himself, this request came, and then response the past, broken, she connected, immediately after the break, That is, no one knows whose existence, unlike QQ, if one side of the line, the other side immediately know that the other side is not online, so HTTP is stateless, and now who do not know who, next time if you want to find this resource, you can not find, then we how to do? And listen to the small series of Slow way:

Assuming Zhang San to access the operation, the server allocated a space for the Zhang San, this space belongs to Zhang San, the whole session can be used, so she called session, if the browser is closed, and start again to access the time, then is another session, not this time, when the Zhang Sanlai visit , will create a seesionid, all will have an identity, this seesionid is not repeated, the creation of the number, after the relevant operation, response return, will take the number back together, if this time, John Doe, will also create an ID for John Doe, Once the access is complete, the number is also taken back, as shown in:

So the session has a concept of timeout, which is released if it is not accessed. The ID of the session is saved in the cookie. Cookies can be disabled, if the browser does not let us write cookies, then how to do it, seesion can not find, how to solve, this time, we use URL rewrite, what is called URL rewrite it? URL rewriting is the process of first getting a URL request to enter and then rewriting it to another URL that the site can handle. For example, if the URL entered through the browser is "userprofile.aspx?id=1" then it can be rewritten as "userprofile/1.aspx", such URLs, such URLs can be better read by the site. If the browser does not support cookies or the user blocks all cookies, the session ID can be appended to all URLs in the HTML page, which are sent to the customer as a response. This way, when the user clicks the URL, the session ID is automatically sent back to the server as part of the request line rather than as a header row. This method is called URL rewrite (url rewriting).
URL Rewriting
URL rewriting is the process of first getting a URL request to enter and then rewriting it to another URL that the site can handle. For example, if the URL entered through the browser is "userprofile.aspx?id=1" then it can be rewritten as "userprofile/1.aspx", such URLs, such URLs can be better read by the site.
If the browser does not support cookies or the user blocks all cookies, the session ID can be appended to all URLs in the HTML page, which are sent to the customer as a response. This way, when the user clicks the URL, the session ID is automatically sent back to the server as part of the request line rather than as a header row. This method is called URL rewrite (url rewriting).
In general, URL rewriting is a very robust way to support sessions. This method should be used in cases where the browser is not sure whether cookies are supported. However, the following points should be noted when using URL rewriting:
1. If URL rewriting is used, all URLs should be encoded on all pages of the application, including all hyperlinks and the form's Action property values.
2. All the pages of the application should be dynamic. Because different users have different session IDs, you cannot attach a session ID to a URL on a static HTML page.
3. All static HTML pages must be run through the servlet, which overrides the URL when it sends the page to the customer.
What are the drawbacks of URL rewriting? Use URL overrides for all URLs, including hyperlinks, action for form, and redirected URLs. Each URL that references your site, and the URLs that are returned to the user (even through indirect means, such as the Location field in server redirection), add additional information. This means that you cannot have any static HTML pages on your site (at least static pages cannot have any links to site dynamic pages). Therefore, each page must be dynamically generated using a servlet or JSP. Even if all the pages are generated dynamically, if the user leaves the session and comes back again via a bookmark or link, the session information is lost because the stored link contains the wrong identity information-the session ID after the URL has expired.After the introduction of the session, small make a simple introduction to the cookie.
Basic principles of cookies
The meaning of a cookie in English refers to the dessert that is eaten with this milk, however, in the Internet, the word cookie has a completely different meaning, then what is a cookie, cookie is a small amount of information, sent by the Web server to store in the Web browser, So the next time this unique visitor returns to the Web server, this information can be read back from the browser, which is useful to let the browser remember the visitor's specific information, which is useful for the browser to remember the visitor's specific information, such as the last visited location, the time spent or user preferences such as style sheets, A cookie is a text file stored in a browser directory that, when the browser is running, is stored in RAM and, once exited from the Web site or Web server, the cookie can be stored on the computer's hard drive, and all cookies are terminated when the visitor ends their browser conversation.
Simply put, the meaning of a cookie is the dessert that the server sends to the browser, that is, when the server responds to the request, it can save some data in the form of a "key-value" pair in response to the client, and when the browser accesses the same app again, the original cookie is brought to the service side via the request message. As in the following code, the servlet shows the functionality of the cookie:

 public void doget (HttpServletRequest request, httpservletresponse response) throws Servletexcepti              On, IOException {response.setcontenttype ("text/html");              PrintWriter out = Response.getwriter ();              String option = request.getparameter ("option");                   if ("Show". Equals (option)) {//Get the Cookie data in the request information cookie[] cookies = request.getcookies ();  if (cookie = null) {//Find out the name (key) for the "Cool" cookie for (int i = 0; i < cookies.length; i++) {if ("cool". Equals (Cookies[i].getname ())) {Out.println ("

cookies can be used to keep the user's session state, but the cookie information is stored on the client, There is a large security risk, and the general browser of the number of cookies and their data size is strictly limited, in the Web application, in general, through the HttpSession object to maintain session state, each cookie can set a maximum life cycle, if the value is set, The browser will write the cookie to the hard disk, but if the cookie is not set to its maximum lifetime, such cookie becomes a session cookie, and she is in memory, and the cookie disappears when the browser is closed.
cookie and Session differences
A, cookie data is stored on the client's browser and the session data is stored on the server.
B, cookies are not very secure, others can analyze cookies stored locally and cookie spoofing, taking into account that security should use Seesion.
C, session will be saved on the server for a certain period of time, when the increase in access, will be compared to occupy the performance of the server.
D, a single cookie on the client limit is 3k, that is, a site in the client store cookies can not be greater than 3k.
small message: the blog post, The small series mainly introduces the differences between seesion and cookies, URL rewriting, and session and Cookie. Small part of the introduction are some simple theoretical knowledge, for the session and the specific role of cookies, but also need us in the actual project a lot of experience. Java learning, not to be continued ...

In layman's seesion and cookies