Servlet sessions

Question

As per theory an HttpSession is needed only in case the following three conditions are met
1. Your application entails multiple http requests.
2. You need to remember certain data between requests.
3. There is a server side object that needs to persist between requests.
OK now I am having difficulty in fully understanding and applying what this exactly implies. Consider a use case a client logs into a service through a trusted portal i.e., the portal authenticates the user creates a hash and sends over the login and the hash over to an application using a servlet. The servlet(application) authenticates the portal using the hash and lets the user log in to perform various functions. Now in this scenario lets suppose the request to the application for authentication consists of LoginID and Hash
http://myApplication.eu.com/servlet/Login?LoginID=amit234&Hash=123465432355765432344566788766544
now here do we need to store the LoginID and the Hash in a session or not and why?
Thanx for replying.

Answer 1

An HttpSession is not necessarily needed in the three
conditions you list.
1. Doesn't matter...you may not need to maintain
state.
2. You need to maintain state. You can embed a token
in the page
url, or cookie and retrieve the information from a
m a data store.
3. You can persist an object independant from an
HttpSession.
In your use case study:
You do not need to use an HttpSession. After
authentication you can embed a unique token in the
page, url, or client cookie. Which will need to be
checked each time your client access a safe page.
Of course using a HttpSession is convenient.
You would need more than a LoginID each time if you do
not use a session. If you are using a session then you
do not need either, as the session takes care of that
for you.
Hi,
But am i wrong in saying that the a servlet is instantiated only when its first loaded not with each request. If thats the case, how are u going to differentiate between same attributes of different requests. Is it that the servlets use different threads for the purpose which are distinct and unique for each request or do they employ some other method to achieve this?