In this section of the tutorial, we will work on HTTP session tracking. Since HTTP is stateless protocol, there is a need to provide a mean to track user activities on servers. Typically, there are 3 methods used for this:

• Cookies: These are small files that contains session information, or any other data that server may send to the browser. Cookies are widely used, but are tedious and error prone to work with. Also, cookies can be disabled in a browser, or it may not support cookies at all.
• URL re-writing: It involves appending extra session data to the URL. This has advantage over cookies in that it can''''t be disabled or unsupported, but still requires significant amount of tedious and error prone handling
• Hidden form fields: HTML forms can have hidden fields that contain session data, which are included in GET or POST request. But, it only works if each page is dynamically generated to include session information.

To address any of these shortcomings, servlet specification defines HTTP session API. This is high-level API designed on top of cookies or URL rewriting. If the browser supports cookies, they will be used, otherwise falls back to URL rewriting.

Using HttpSession API:

To retrieve current session object, you can simply use getSession() method:

HttpSession session = request.getSession(true);

If method argument is true, new session will be created in case there''''s no existing session. Otherwise, current session will be returned.

Sessions can also hold arbitrary data in form of session attributes. Here are methods used to get or set session attributes:

• putAttribute(name,value) – sets new attribute value for a given attribute name
• getAttribute(name) – retrieves value of attribute with given name
• getAttributeNames() - retrieves names of all attributes defined within a session

The following code snippet shows a sample of session API usage:

public class SessionServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        HttpSession session = req.getSession(true);

        Integer currentSum = (Integer)session.getAttribute("sum");
        if(currentSum == null){
            currentSum = 0;
        } 
        currentSum++;
        //write result
        resp.setContentType("text/html");
        resp.getWriter().print("Current sum: " + currentSum);

        session.setAttribute("sum", currentSum);
        resp.flushBuffer();
    }
}

Here, we first retrieve the session object. If none exists, new session will be created. Then, we query the session for attribute name “sum”, and increment it. Finally, value of “sum” is printed to the browser.

If you reload the page, you will see the sum increasing. With each reload, it will be incremented by one.

Don''''t forget to add servlet configuration to web.xml

<servlet>
      <servlet-name>sessionServlet</servlet-name>
      <servlet-class>com.beyondrelational.SessionServlet</servlet-class>
  </servlet>
<servlet-mapping>
      <servlet-name>sessionServlet</servlet-name>
      <url-pattern>/sessionservlet</url-pattern>
  </servlet-mapping>

This simple example demonstrates rudimentary usage of session API. In real world applications, sessions are used for a lot of stuff, such as login, shopping carts etc. For more insight full look, check out HttpSession API in servlet specification at http://docs.oracle.com/javaee/5/api/javax/servlet/http/HttpSession.html.

Find the sample web application here.