Session learning, session

Session learning, session

The session mechanism is a server-side mechanism. The server uses a structure similar to a hash (or a hash) to save information.
When a program needs to create a session for a client request, the server first checks whether the client request contains a session id called session id, if a session id is included, it indicates that a session has been created for this client before, and the server uses the session id to retrieve the session. (If NO session id is found, a new session may be created ), if a client request does not contain a session id, the client creates a session and generates a session id associated with the session. The cookie can be used to save the session id, so that the browser can automatically display the id to the server according to the Rules during the interaction. Generally, the cookie name is similar to SEEESIONID. For example, for weblogic cookies generated by web applications, JSESSIONID = ByOK3vjFD75aPnrF7C2HmdnV6QZcEbzWoWiBYEnLerjQ99zWpBng! -145788764, whose name is JSESSIONID. This session cookie is stored in the browser memory.

"As long as the browser is closed, the session disappears. The session is created by the server. to delete a session, the server will keep it unless the program notifies the server to delete a session.

However, the browser will not notify the server when it is closed, so the server will not know that the browser is closed. This is because most session mechanisms use session cookies to save session IDs,

When the browser is closed, the cookie will be destroyed, so the session id disappears and the original session cannot be found when the server is connected again.

If the cookie set by the server is saved to the hard disk, or the HTTP Request Header (URL rewriting) sent by the browser is rewritten by some means, the original session id is sent to the server, then you can still find the original session when you open the browser again.

Session Persistence:

<% @ Page language = "java" contentType = "text/html; charset = UTF-8" pageEncoding = "UTF-8" session = "true" %> <! DOCTYPE html PUBLIC "-// W3C // dtd html 4.01 Transitional // EN" "http://www.w3.org/TR/html4/loose.dtd"> 
 
URL rewriting:
When the Web server returns Response, it checks all URLs on the page, including all connections, and the Action attributes of the HTML Form, and adds "; jsessionid = XXX" after these URLs ".
Next time, the user accesses the URL on this page. Jsessionid is passed back to the Web Server.
<Form action = "<% = response. encodeURL ("hello. jsp ") %>" method = "post"> username: <input type = "text" name = "username" value = "<% = username %>"/> <input type = "submit" value = "Submit"/> </ form> <a href = "<% = response. encodeURL ("login. jsp ") %>"> log on again </a>
 
Set session Timeout:
Closing the browser will not cause the session to be deleted, forcing the server to set an expiration time for the seesion. When the last time the session was used by the client exceeds the expiration time, the server considers that the client has stopped the activity before deleting the session to save storage space. In general, we will configure
<Session-config> <session-timeout> 30 </session-timeout> <! -- 30 minutes --> </session-config>
Session lifecycle:
1. session Creation Time
A common misunderstanding is that the session is created when a client accesses it. The fact is that the session is created until a web server calls HttpServletRequest. the getSession (true) Statement is created only when it is not displayed, when the JSP file is compiled into Servlet, the following statement is automatically added: HttpSession session = HttpServletRequest. getSession (true); this is also the source of the implicit session Object in JSP. Because the session consumes memory resources, if you do not plan to use the session, you should disable it in all JSPs, <% @ page session = "false" %>. Note that this attribute is only disabled.
The implicit object of session in jsp, we can still explicitly use session
<% HttpSession session = request. getSession (true); out. println (session); out. print ("<br>"); // obtain the maximum validity period of the Session. The default value is 30 minutes. out. print (session. getMaxInactiveInterval (); session. invalidate (); %>
Conclusion: The session creation time is the first time that the client interacts with the wb server and the web server calls HttpServletRequest. getSession (true );
Session Object destruction:
① Directly call invalidate () of HttpSession ()
②. The HttpSession has expired.
> Maximum response time: getMaxInactiveInterval () is measured in seconds.> set the maximum response time: setMaxInactiveInterval (int interval)
> You can configure the maximum Session validity period in the web. xml file, in minutes.
<Session-config>
<Session-timeout> 30 </session-timeout>
</Session-config>
③ Uninstall the current WEB application. Note: closing the browser will not destroy the Session!