Session Management

Session management is crucial in web applications for maintaining user-specific data between multiple HTTP requests. Since HTTP is stateless, session management helps track and manage user activities across requests.

Cookies

A cookie is a small piece of data stored on the client-side (browser). It can be used to store user-specific information, such as authentication status or preferences. Cookies are sent with every HTTP request to the server, allowing the server to recognize returning users.

• Creating a Cookie
  
  1 2	Cookie cookie = new Cookie("username", "john_doe"); response.addCookie(cookie);

• Reading a Cookie
  
  1 2 3 4 5 6

  Cookie[] cookies = request.getCookies(); for (Cookie cookie : cookies) {     if (cookie.getName().equals("username")) {         String username = cookie.getValue();     } }

Pros: Simple, client-side storage.
Cons: Limited storage capacity and security concerns, as data is visible on the client.

URL Rewriting

URL Rewriting is a technique where session data is appended to the URL itself. It’s commonly used when cookies are disabled on the client browser. The server sends the session ID as part of the URL, enabling the server to track the session.

• Encoding a URL with session ID
  
  1 2	String url = response.encodeURL("welcome.jsp"); out.println("<a href='" + url + "'>Click here to go to the welcome page</a>");

When the user clicks the link, the session ID is included in the URL, and the server can identify the session.

Pros: Works when cookies are disabled.
Cons: Not very user-friendly and can expose sensitive session data in the URL.

HttpSession

HttpSession is the most common session management technique in Java. It provides a way to store session data on the server side, making it more secure than cookies and URL rewriting.

• Creating a Session
  
  1 2	HttpSession session = request.getSession(); session.setAttribute("username", "john_doe");

• Reading from Session
  
  1	String username = (String) session.getAttribute("username");

HttpSession can store various data types (objects, strings, etc.) and provides methods to manage session timeout and invalidation.

Pros: Secure, server-side storage.
Cons: Uses server resources, and data is lost if the server restarts.