How can I use active user session that's in an application scope Hashtable?

Question

First of all, is it possible to use the same session after a user exits and then returns?
Second, if it is possible, then please tell me what I need to do. So far, this is what I have been doing...
1.) The user submits login credentials
2.) The user is authenticated.
3.) The user does not have an existing session, so a new one is created.
4.) The user closes the browser.
5.) The user returns to login page and submits login credentials.
6.) The user is authenticated.
7.) The user has an existing session, so it should be used.
This is where I'm having trouble. All active sessions for my application are stored in a Hashtable. I have been using <%@ page session="false" %> so that a new session is not automatically created. Each time before I create a new session, I check my Hashtable to see if that user has an existing session. If a session exists for that user, then I would like to continue using that session if possible. I have used the methods request.getSession() and request.getSession(false), but a new session is always returned.
I could create a new session, copy the attributes from the old session(which is stored in my Hashtable) to the new session, and then invalidate the old session, but I'd rather not do that.
Is there a way that I can use existing sessions that I have stored in my Hashtable?

Answer 1

First of all, is it possible to use the same session after a user exits and then returns?No, I don't think so. Let me explain why. When the server creates a session object for each client, it needs to know which client is making the request. Remember that HTTP is a stateless protocol. Every time a client makes a request, it sends some sort of session id to the server to let the server know who is trying to make the request. The server will then check to see if a session object exists for that particular client and if so, it will make sure that the max inactive interval (maximum time alloted for that client's session) has not been exceeded. If every thing is okay, then the client can access the session object to get values that were previously placed there. There are many ways that servers try to keep track of clients. One way is to have the clients write the session ID using cookies. But, many people like disallow cookies. So some servers do what is known as URL rewriting. That is, they will write the session ID on the end of the query string. This can also be accomplished programmatically, but it can be taxing to do. Anways, the point is that the client and the server have to have some sort of link between each other and that link is the session ID. So, if the browser is closed, the session ID is lost. That particular client will be forced to get a new session ID the next time the following code is executed:
//create a session object and set its values
HttpSession session = request.getSession(true);>
Second, if it is possible, then please tell me what I
need to do. So far, this is what I have been doing...
1.) The user submits login credentials
2.) The user is authenticated.
3.) The user does not have an existing session, so a
new one is created.
4.) The user closes the browser.
5.) The user returns to login page and submits login
credentials.
6.) The user is authenticated.
7.) The user has an existing session, so it should
be used.If you really want to do something like this, you could make up your own ID and store it as a cookie on the client. I've never tried anything like this before so you would have to do your own research. Are you sure you want to do something like this. There is a reason why it works the way it does. There is also a reason why you want to keep the session timeout value some what small. Let me give you an example of some craziness with sessions. A client we once had wanted to keep their sessions open for 4 hours because they said there clients simply did not like to log in all the time. I nearly gasped when I was told we needed to do this. When you make the session time out large (i.e. the maxInactiveInterval( )), then session objects stick around longer in the server. Let's say a client logs into the server and receives a session object. Then, the client makes a few requests. The server knows to keep the session alive as long as the time between requests has not exceeded 4 hours. Then the client closes the browser. How is the server suppose to know that the browser was closed. Well, it doesn't. It just knows to check times between requests. So, that particular session object won't be garbage collected until the session times out. What if a whole bunch of clients did this. Yucko. The server would have a whole bunch of session objects living in memory. What a waste. This is all above and beyond the typical security problems that can arise from having a session open for so long. To make a long story short, you really shouldn't do what you are trying to do unless it is the nature of the app.
>
This is where I'm having trouble. All active sessions
for my application are stored in a Hashtable. I have
been using <%@ page session="false" %> so that a new
session is not automatically created. Each time
before I create a new session, I check my Hashtable
to see if that user has an existing session. If a
session exists for that user, then I would like to
continue using that session if possible. I have used
the methods request.getSession() and
request.getSession(false), but a new session is
always returned.
I could create a new session, copy the attributes from
the old session(which is stored in my Hashtable) to
the new session, and then invalidate the old session,
but I'd rather not do that.
Is there a way that I can use existing sessions that I
have stored in my Hashtable?