Question

Sessions have a life cycle. Describe the phases of a Tomcat session from inception to death. Need atleast 300 plus words explanation with reference

Answer 1

When a client visits a webapp for the first time and / or HttpSession is first available with a request.getSession (), the servlet container creates a new HttpSession item, generates a longer and different ID (which you can get per session .getId ()), and then saves it in server memory. The servlet container also places a Cookie in the Set-Cookie subject for HTTP response via JSESSIONID as its name and a unique session ID as its value.

According to the definition of HTTP cookie (the standard web browser and compliant web server), the client (web browser) is required to return the cookie to the following requests in the Cookie subject as long as the cookie is active (meaning the unique ID should refer to the session. unfinished and background and method is ok). Using the built-in HTTP traffic controller, you can verify that the cookie is active (press F12 in Chrome / Firefox 23+ / IE9 +, and check the Net / Network tab). The servlet container will check the cookie header for all incoming HTTP requests for a cookie named JSESSIONID and use its value (session ID) to find the corresponding HttpSession in the server memory.

HttpSession remains active until it expires beyond the expiration date specified in the <session-timeout>, setting in web.xml. The closing time sets in 30 minutes. Therefore, when a client does not visit a web application for longer than the specified time, the servlet container hits the session. All subsequent requests, even if the cookie is specified, will not be able to access the same time; a servlet container will create a new session.

On the client side, the session cookie stays active as long as the browser model works. Therefore, if the client closes the browser instance (all tabs / windows), then the session is discarded on the client side. In the case of the new browser, a session-related cookie would not be available, so it will no longer be sent. This results in the creation of a completely new HTTPSession, when a new session cookie is activated.