Session Lost Issues

Question

Hello, to all expertise
Isnt any people got face session lost issue before?
Project Description
Structs -> (MVC)
Session Time Out(Web.xml)
<session-time-out> 1hours
Application Server
JBoss 4
Windows XP and Internet Explorer 6.0
Using JDeveloper10g as IDE tools
Trying Solutions (But also kenot resolve problems)
1) Increase the session time out
2) Add one class for HttpSessionListener
a) public void sessionCreated(HttpSessionEvent se){}
b) public void sessionDestroyed(HttpSessionEvent se){}
If i not mistaken, the sessionCreated is when first time we go in into the page, then the sessionCreated wont be call unless there was new request or new user... What i trying to say is the sessionCreated is only be call once for one browser.. However, each time when i was doing some transaction or click on any window pop up menu like using javascript : window.showmodaldialog, or alert scriplet, it since got the session will recreated.. But the case is i cant really estimate when the
session will recreated... Each time the session recreated, the attribute and all the value store in that particular will be lost rite?
Further more, i declare one SessionManager.class to store all the session variable include the session id after the user success to login to the screen. Each time when the was transaction in database such as add, update, I will using the vector to store and compare whether the request.getSession().getId is same with the same the sessionid in vector or not... If there was same, then the continue the following task, if there was different between the id in request with the vector, means the session is recretead so i will send redirect to the login page...
For the add and update transaction we will use the alert("Add success"); to inform the user the database have been success added!
But the session lost is after 4 minutes or within 10 minutes very often it happen even the page are activate by the user...
Isnt any one got happen this before? Isnt the alert pop up menu? or isnt the window.showModalDialog cause it?
I didnt use any session.invalidate or any session.remoteatrribute to remove all the session stuff.. How can it will recreated new one?
Very Thanks to have your all useful suggestion and guideline
Thanks and best regards
Kim;

Answer 1

There is a performance penalty for using SSL, but there are solutions to address that penalty (SSL hardware acceleration). And, no, SSL doesn't prevent anyone from guessing anything, but the point of using a UUID for session tokens is to make guessing extremely difficult even with brute-force repetitive approaches.
Dave Watts, CTO, Fig Leaf Software
http://www.figleaf.com/
http://training.figleaf.com/
Fig Leaf Software is a Veteran-Owned Small Business (VOSB) on
GSA Schedule, and provides the highest caliber vendor-authorized
instruction at our training centers, online, or onsite.