This week's book giveaway is in the Java in General forum.
We're giving away four copies of Beginning Java 17 Fundamentals: Object-Oriented Programming in Java 17 and have ishori Sharan & Adam L Davis on-line!
See this thread for details.
Win a copy of Beginning Java 17 Fundamentals: Object-Oriented Programming in Java 17 this week in the Java in General forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Tim Cooke
  • Campbell Ritchie
  • Ron McLeod
  • Liutauras Vilda
  • Jeanne Boyarsky
Sheriffs:
  • Junilu Lacar
  • Rob Spoor
  • Paul Clapham
Saloon Keepers:
  • Tim Holloway
  • Tim Moores
  • Jesse Silverman
  • Stephan van Hulst
  • Carey Brown
Bartenders:
  • Al Hobbs
  • Piet Souris
  • Frits Walraven

Session timeout in general web applications vs social apps

 
Ranch Hand
Posts: 159
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Generally sessions in web applications expire after a stipulated max inactive interval. To my knowledge primarily the reason is if the session objects are not invalidated they keep exhausting the memory. So my question is

A. Is there any other reason other why web applications timeout the user session after an inactive interval?

B. Social sites never timeout the user session even if you just leave them for the entire day. How do they manage sessions? Don't the active sessions exhaust memory on their servers or JVM to be specific?

 
Ranch Hand
Posts: 1376
Eclipse IDE Java
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
For point A , security can be another reason for invalidating session.
For point B, we do have option in Java to configure ever running session. About whether they exhaust memory of JVM depends upon what values do we store in Session.
 
Sheriff
Posts: 67620
173
Mac Mac OS X IntelliJ IDE jQuery TypeScript Java iOS
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
If your session fills up and never empties it's a sign that you are not managing it properly. Just leaving stale data in the session, and counting upon its timeout to clear it out is a poor approach.
 
Sheriff
Posts: 26973
85
Eclipse IDE Firefox Browser MySQL Database
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Also, don't assume that a user's session data has to be stored in memory. There are other strategies.
 
shivang sarawagi
Ranch Hand
Posts: 159
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Thanks for the reply guys. Can you please add any resource link or would want to elaborate on session saving strategies?.
 
Rancher
Posts: 43027
76
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Files or - more likely - a database are other options.
 
Ranch Hand
Posts: 334
2
Netbeans IDE Tomcat Server Java
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Also a session may timeout but not require any user interaction to create another one.

For example the "stay logged in" checkboxes usually store a cookie in the client browser and that can be used to log in the next session.

Joe
 
Saloon Keeper
Posts: 24899
174
Android Eclipse IDE Tomcat Server Redhat Java Linux
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I'm not exactly sure what the question is here, but it's entirely within the rights of a web application server to periodically scan its session collection and discard sessions which have exceeded the timeout limit. In other words, don't expect that you have to explicitly dispose of sessions.

The Tomcat webapp server will store serialized sessions in a work directory. This can cause a session to be have continuity over a shutdown/restart of the webapp server. I haven't checked, but I'm sure there are options that control this. Plus, of course, Tomcat supports alternative session storage to help facilitate clustering between discrete JVMs.
 
WHAT is your favorite color? Blue, no yellow, ahhhhhhh! Tiny ad:
Building a Better World in your Backyard by Paul Wheaton and Shawn Klassen-Koop
https://coderanch.com/wiki/718759/books/Building-World-Backyard-Paul-Wheaton
reply
    Bookmark Topic Watch Topic
  • New Topic