Are session attribute not thread safe? p-199 on HFSJ

[Pawanpreet Singh]

Could anybody let me know that why session attributes are not thread?

I have written following servlet

public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException,ServletException
{
response.setContentType("text/html");

String user = request.getParameter("user");
HttpSession session = request.getSession();

if(session.getAttribute("user")==null)
session.setAttribute("user",user);

PrintWriter out = response.getWriter();
out.println("session :"+session.getAttribute("user"));
}

When i open a browser and write
http://localhost:8080/chap5/testsession.do?user=pawan

it displays

session : pawan

again when i open a new window (it means a new session attribute)
http://localhost:8080/chap5/testsession.do?user=bert

it displays

session : bert

The second time : if(session.getAttribute("user")==null)
session.setAttribute("user",user);

again session attribute is null for id "user".

Could any body provide me a clear picture that how the same session attribute can be accessed when we open a new Broswer window and send a request for same.

Thanks in advance

[Pawanpreet Singh]

Also on page - 198, it is mentioned that

"session persists along multiple requests for the same client"...

Also one more line

"Could you think of scenario in where there could be more than one request at same time from same client"

Could anybody light on word "client" here.

Is "Client" a "browser" or a PC machine.

Thanks in advance.
Pawan

[Pawanpreet Singh]

Is a new client mean : new window opened from a browser window, which is like a child window? In that case, both browser windows will share same session. Is it?

To Bert : Could you please answer my question.

Thanks & Regards,
Pawan
SCJP 5.0, Preparing for SCWCD 1.4

[Sreeraj G Harilal]

Pawan preet,
You code is perfect to check a session. If you close all the browser windows, the session will be lost. You must always open atleast one browser window for the session.

Open a window and type
http://localhost:8080/chap5/testsession.do?user=pawan

it will display :-
session : pawan

Then again open a new window. But remember don't close the pervious window before a new window is open.
Request with a new user parameter
http://localhost:8080/chap5/testsession.do?user=Sreeraj

it will display the previous user name in the window like
session : pawan

[Pawanpreet Singh]

Thanks Shreeraj for this explaination. Actually i was openeing IE from original short cut instead of File Menu > New > Window.

When i open a new window using File Menu> New > Window. It is sharing the session.

But if i open a new window using IE icon on my desktop. It gets a new session.

Could you explain the difference please.

Thanks for previous explaination.

[Sayak Banerjee]

Try Mozilla Firefox instead of IE...you'll definitely not find the same problem...and stop using IE for testing purposes...it's got a lot of problems like these.

Also, keep one thing in mind...when you close all the browser windows, you lose the session, but it does NOT become invalid.
[ December 21, 2006: Message edited by: Sayak Banerjee ]

[Sreeraj G Harilal]

Yes Pawan preet, you are right. But i don't know how it is happening like this.
I am using mozilla. It does not have any problem like this.

[Pawanpreet Singh]

Thanks Sreeraj. I am going to try for Mozila.


So it means, session is not unique to a browser and is machine specific.

Is it right.

[Sayak Banerjee]

The problem with IE is a different issue....you'll find other issues with IE as well...
As for sessions...It's got nothing to do with browser or machines....it regarding a specific user...just remember this...and there are 3 ways it can know that it's talkin' to the same user...through cookies, URL rewriting or SSL....since in your case you're using cookies, closing all browser windows would make the cookies disappear....so even though the session might not have become invalid, it's lost for you...because now when you open up a new browser window, you'll get a new session

[Pawanpreet Singh]

Thanks Sayak Banerjee.

[Ali Gohar]

I think you can overcome this problem by using response.encodeURL() method which will send the session id with each request.

However for this you will have to disable cookies at your side and then it will work with IE.

I think we can also set some property in Tomcat to disable the cookies but not sure

[Sayak Banerjee]

I think you can overcome this problem by using response.encodeURL() method which will send the session id with each request.

With URL rewriting, you'll never get the same session if you open up a different browser window, 'twill only work with one window.

[Pawanpreet Singh]

Thanks Sayak Banerjee.