SESSION TRACKING IN SERVLETS
Session simply means a particular interval of time.
Session tracking in Java is a mechanism that allows a servlet to
"remember" information about a user across multiple requests
Session Tracking is a way to maintain state (data) of an user. It is also
known as session management in servlet.
Http protocol is a stateless so we need to maintain state using session
tracking techniques. Each time user requests to the server, server treats
the request as the new request. So we need to maintain the state of an user
to recognize to particular user.
It is shown in the figure given below:
Why use Session Tracking?
It is used to recognize the particular user.
Session tracking is important for tracking conversions in online shopping,
mailing applications, and E-Commerce applications.
Real-life Example: Online Shopping
Imagine you're shopping on an e-commerce website. Here's the flow:
1. You visit the website and start browsing products.
2. You add a product to your shopping cart.
3. You continue browsing and add more items to your cart.
4. When you're ready, you proceed to checkout and enter payment details.
Throughout this process, the server needs to remember the items you've added
to your cart, even though each page you load is a new request. This is where
session tracking comes in.
Session Tracking employs techniques
1. Cookies
2. HttpSession
A. Cookies
Cookies are little pieces of data delivered by the web server in the response
header and kept by the browser. Each web client can be assigned a unique
session ID by a web server. Cookies are used to keep the session going. Cookies
can be turned off by the client.
Example:
Session Cookie: A cookie with a session ID (e.g., JSESSIONID=12345;).
The server uses this session ID to retrieve the session and its associated
data.
B. HttpSession
A user session is represented by the HttpSession object.
A session is established between an HTTP client and an HTTP server
using the HttpSession interface.
A user session is a collection of data about a user that spans many HTTP
requests.
The HttpSession interface allows you to store data that will be available
for the user's entire session.
When a user first accesses the website, a unique session ID is generated.
This ID is then sent to the client (browser), usually as a cookie, so that the
server can remember who the user is on subsequent requests.
User A and User B both are requesting to connect to a server.
The servlet container uses the HttpSession interface to connect to the
server by creating a unique id for each request.
The unique id is used to identify a user. The unique id can be stored in a
request parameter or in a cookie.
Key Methods of HttpSession:
getSession(): Retrieves the session associated with the current request. If
the session doesn’t exist, it creates a new one.
setAttribute(String name, Object value): Stores an object in the session
under a given name.
getAttribute(String name): Retrieves an object from the session by its
name.
removeAttribute(String name): Removes an object from the session.
invalidate(): Ends the session and removes all session attributes.
Key Differences between Cookies and Session Tracking
Storage Location:
o Cookies store data on the user's device.
o Session tracking typically stores data on the server, with session
IDs being used on the client-side (e.g., in cookies or URL
parameters).
Persistence:
o Cookies can persist across sessions and can be stored for longer
periods.
o Session tracking is temporary, lasting only as long as the session,
and expires when the session ends (browser closes or times out).
Data Storage:
o Cookies can hold a variety of data (preferences, authentication
tokens, etc.) on the client-side.
o Session tracking usually only stores data necessary for the
duration of the session (e.g., shopping cart items, user actions
during that visit).