22

Are the objects serialized and sent to the user and back on each connection (stored in cookies) ?

Or are they stored in the server heap and the cookie is only a very small identifier ?

Any information about this topic would be helpful.

Thank you

1

2 Answers 2

23

You got it on the second guess.

The cookie contains a JSESSIONID. That id is used to look up the user's HttpSession in a map that the server maintains. At least this is the most common way. There are more intricate ways that the server can implement this, but shuttling the entire state back an forth in a cookie isn't one of them.

This has some implications. First, if the server goes down, you lose session state. Second, if you have a server cluster, you need to get the user connected to the same server each time, or they will lose their session between subsequent requests. Lastly, session hijacking becomes a possibility if someone finds a way to copy someone else's JSESSIONID and replace theirs with it.

3
  • Are there any safe alternatives? Apr 29, 2011 at 23:06
  • 10
    Your last paragraph is not entirely accurate. Popular Java web servers (at least Tomcat and JBoss) can be configured to persist session state to disk so that it can be preserved across a crash or server restart. The same servers also support sharing session state between all nodes in a cluster so that the user can hit any node in the cluster without losing their session (and so that if a cluster node goes down, the user can continue their session with a different node as if nothing has happened).
    – aroth
    Apr 29, 2011 at 23:20
  • 3
    @aroth - You are correct. My second paragraph was referring to the issues to the most common way sessions are handled in Tomcat, especially as it comes out of the box (so to say). I alluded to the more intricate systems available, but didn't think that this question required a deep dive into all the intricacies of persistent/shared sessions. If you look at the original question, all it was asking for was clarifications on how the cookies worked for session state. I intentionally left out all the different possibilities.
    – rfeak
    Apr 30, 2011 at 23:01
8

The cookie just contains a session identifier (typically called JSESSIONID). The server maps this identifier to whatever data is currently stored in the user's session.

The data itself may be stored in memory, or it may be serialized to database or to file depending upon what server you are using and its configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.