The correct answer is HttpSessionAttributeListener.
HttpSessionBindingListener is implemented by an object so that the object itself will be notified if it is bound or unbound to a session. That will not work for all objects (for instance,
String does not implement this interface, so a String instance can't be notified when it is added to a session).
HttpSessionAttributeListener is implemented by a class when that class wants to be notified that any attribute has been added to the session. That is the other difference: HttpSessionBindingListener can only notify a specific object that it has been added; HttpSessionAttributeListener is notified when any attribute has been added.
So, when you develop a class that is to be notified when any attribute is added to a session, you would implement HttpSessionAttributeListener, and then register that class through the listener element of the deployment descriptor. The listener element takes the fully qualified name of the class, not the listener interface.
[ January 20, 2003: Message edited by: Kevin Mukhar ]