Another question about sessions

[Andrew Shafer]

Does anyone know if there is a way to access all the active session values at one.
Is there anything built into the API that will allow me to check all the values that are part of every active session?
For example, if I name and set a session attribute as "username", can I check all active sessions for the value of "username"?
I think I could write a class that will keep track of the session id and then check the attribute values, but I was wondering if there was anything built in that will do this.

[maha anna]

Andrew,
Threre is (was) a deprecated API called HttpSession.getSessionContext() which will return the SessionContext to which all user sessions are bound. PLease See this API link.
http://java.sun.com/products/servlet/2.2/javadoc/javax/servlet/http/Ht tpSession.html#getSessionContext()
Using this HttpSessionConytext object's methods getIds() and getSession(id) we can do the trick. But for security reasons these APIs are going to be removed in future servlet versions.
http://java.sun.com/products/servlet/2.2/javadoc/javax/servlet/http/ HttpSessionContext.html#method_summary
The reason is nicely explained in this article.
http://www.webreview.com/1999/01_08/developers/01_08_99_3.shtml

The getIds() method returns an Enumeration that contains the session IDs for all the currently valid sessions 
in this context or an empty Enumeration if there are no valid sessions. getSession() returns the session associated with the 
given session ID. The session IDs returned by getIds() should be held as a server secret because any client with knowledge of 
another client's session ID can, with a forged cookie or URL, join the second client's session. 

regds
maha anna

[This message has been edited by maha anna (edited April 27, 2001).]

[Phil Hanna]

There are two ways to do this:
1. Write a session monitor class that implements HttpSessionBindingListener, and store an instance in each session that you create. There is a full example in chapter 7 of Instant Java Servlets - you can download the source code from http://www.philhanna.com - see Figures 7-14 through 7-19 in the xref.
2. Servlet API 2.3 (supported by Tomcat 4.0, among others) introduces event listeners for just this purpose. An HttpSessionListener is notified when sessions are created and destroyed, and an HttpSessionAttributesListener is notified when any session has attributes change.
------------------
Phil Hanna
Sun Certified Programmer for the Java 2 Platform
Author of :
JSP: The Complete Reference
Instant Java Servlets
Website: http://www.philhanna.com

[Andrew Shafer]

Sweet!
Thanks Phil and Maha

[maha anna]

I think it's time to upgrade to servlet 2.3! We are getting older too soon... Isn't?
regds
maha anna

[sjhyam m]

Hi Phil Hanna!
I need you answer to my question. I have bound a class to my session in a Servlet on iPlanet App server. I have to execute some code when the bound and unbound methods are called. I thought that the method unbound will be called when I remove the particular class from the session or when the session expires. I have verified the same with JWS. But in iPlanet the method valueUnbound() is called immediately after value bound is called. What will be the problem with it. Is there specail way to handle it in iPlanet App server?
Bye!
shyam