Java: session details

The book says:
In the following cases, when the session ends, the servlet container releases the resources occupied by the session:
1. Close the browser on the client
2. session expiration
3. The server calls the invalidate () method of httpsession.

"A browser is a new session, and the session ends after the browser is closed"
The session is created on the server. A session ID is generated when the browser accesses the server. The session ID is used by the browser to locate the session on the server. The session creation and destruction are controlled by the server.When the browser is closed, the session still exists on the server side, but when you access the server in the new browser, another session will be created. At this time, the sessionid is different. You cannot access the content of the last session.

"Session creation and destruction are controlled by the server". Only sessions are available on the server. The client matches the session only through the sessionid.
How to Create a server session? Normal HTML is not created,JSP is created by default. As long as you access any JSP, it will be created (but only once). If you close the browser and access it again, you will create one, these created sessions are destroyed by the server itself. You can alsoCode.

Under what circumstances do I need to use this server-side session method?
By default, when JSP is accessed, a session will be created (empty at first without data), and the Code in your application will only put data into the session. On the Internet, you can <% @ page session = "false" %> to prevent jsp from automatically creating sessions. I tested it myself (using sessionlistener) and it didn't work at all. The session was created successfully.
Finally, only the server has a session. The cookie is stored locally on the client, but the security is low. Therefore, important data cannot be stored.

========================================================== ==========================================

Sesion is actually simple:
First request. getsession (): When a session is related to the previous request, a reference to this session is returned. If it is not, a session is generated. A session is identified by a sessionid on the server. In other words, a server does not have two sessions with the same sessionid.

So why does a session get together with a cookie?

As I said, for a session, its sessionid is its identity. If we save this sessionid to the user end, this sessionid will be placed in the Request Header (that is, the cookie we are talking about) when a post-ordered request of the same session is sent) in this case, you can verify whether the request is in the same session as the previous request!

What is a session?
We can understand it in a simple way. As long as your browers is off, we call this series of requests and response as a session. When you close the session, it means the session has ended. Although the session ends, it does not mean that your session will be destroy, because the session will survive on the server. Its life is completely dominated by the server (set in Web. XML ).
Although your session is still on the server, you can no longer obtain it.Because the J2EE API only provides us with one method to obtain the reference of the session related to the current session: request. getsession () or reqeust. getsession (Boolean)
========================================================== ====================================

A common misunderstanding is that the session is created when a client accesses it. However, the fact is that the session is created until a serverProgramCreated only when a statement such as httpservletrequest. getsession (true) is called,Note: If the JSP file is not displayed and the session is closed using <% @ page session = "false" %>, the JSP file will automatically add such a statement httpsession session = httpservletrequest when compiling the file into servlet. getsession (true );

This is also the source of the implicit Session Object in JSP.

<, can JSP display use <% @ page session = "false" %> to prevent the server from creating a sessionid? In this experiment, ************************* & gt;
<% @ page session = "false" %>
the session is not allowed to be created on the page, but cannot be used on this JSP page. network data transmission can be reduced.