File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes Tomcat and the fly likes Is the HttpSession per Tomcat session or per client? Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of OCA/OCP Java SE 7 Programmer I & II Study Guide this week in the OCPJP forum!
JavaRanch » Java Forums » Products » Tomcat
Bookmark "Is the HttpSession per Tomcat session or per client?" Watch "Is the HttpSession per Tomcat session or per client?" New topic
Author

Is the HttpSession per Tomcat session or per client?

Kim Kantola
Ranch Hand

Joined: May 17, 2001
Posts: 274
Hi All,
I have the following code in my java servlet application :


If I use the setAttribute and getAttribute methods to store data in the session, is that data shared with all clients who access the application running under tomcat ? I had thought if I stored something in the session that it was only used by that particular client, but I am starting to see behaviour which indicates that other clients accessing the web app are using that data.

I think I am misunderstanding something global here.

What is happening is I have a table of data and I click on a column heading to re-sort the data based on that column. I save the sort column to the session so when the table auto-refreshes it knows how to sort. Well, another client running on a seperate PC autorefreshes and now has that same sort order as the first client.

Any info appreciated, thanks!
Marco Ehrentreich
best scout
Bartender

Joined: Mar 07, 2007
Posts: 1282

Hi Kim,

a HttpSession is specific to one particular client. The sessions are maintained via cookies or URL rewriting if cookies are disabled.

The strange behavior you're encountering may be because you have multiple browsers windows opened on one machine or multiple tabs in own browser window. This depends on the browser if it's possible to determine it as different sessions. Generally the attributes in session scope should not be accessible to other clients!

Marco
[ June 03, 2008: Message edited by: Marco Ehrentreich ]
Kim Kantola
Ranch Hand

Joined: May 17, 2001
Posts: 274
Hmm, what I have is a java-struts web app running on a server under tomcat. Then I have a client using IE 7.0 on client machine A. I also have a client using IE 6.0 on client machine B. When I sort on machine B in the 6.0 browser, the 7.0 browser on machine A resorts when it hits its refresh time (every minute).

I wonder if when I start up the second browser, on machine B, I am getting access to the session that started with machine A ?
I do use this code in one of my classes,



Could that be doing it? I pass the false so I can see if the session has expired and I need to make the user log in. I thought this would only check on the session per this client, but maybe it will go and find any open session?
Bear Bibeault
Author and ninkuma
Marshal

Joined: Jan 10, 2002
Posts: 61456
    
  67

Sessions will not be shared across clients. Period.

The type of cross-client data pollution problem you are describing is usually a result of thread safety issues in your JSPs or servlets.

Do you use instance variables in your servlets?

Do you use the <%! %> declaration scriptlets in your JSPs?

Both of these will result in the types of problems that you are seeing.
[ June 03, 2008: Message edited by: Bear Bibeault ]

[Asking smart questions] [Bear's FrontMan] [About Bear] [Books by Bear]
Kim Kantola
Ranch Hand

Joined: May 17, 2001
Posts: 274
Thank you so much for your reply. I have been reading other similar posts on JavaRanch and have seen the mention of using instance variables in servlets, and I do (I have an object that holds some static data), but not this particular sort variable. It is not saved as as an instance variable in the servlet, it is saved to a struts form variable, so not sure how this is happening.
Kim Kantola
Ranch Hand

Joined: May 17, 2001
Posts: 274
Hey, I was thinking about static data when you said "instance variables", but taking a second look at my struts action class, I do have a data member in this action class that holds the sort field, would this be an example of what you mean that could be causing me woes ?

Marco Ehrentreich
best scout
Bartender

Joined: Mar 07, 2007
Posts: 1282

Hi Kim,

like Bear already said all member variables (static or non-static) which are shared between multiple threads without correct synchronization are subject to such subtle errors or misbehaviors.

For Java web applications there's even multi-threaded access (for some objects) if you don't explicitly create multiple threads because this is done by the servlet container (Tomcat) for obvious performance reasons.

Unfortunately I don't know the architecture and concepts of Struts, so I can't tell you if this DispatchAction could be shared between multiple threads. But the problems you've described seem to be very good candidates to multi-threading issues.

Marco
Marco Ehrentreich
best scout
Bartender

Joined: Mar 07, 2007
Posts: 1282

Here's one more thing I found on the internet:

Actions have a life cycle similar to servlets. They are like servlets and they're multithreaded. We must be careful when working with member variables of an action because they are not thread safe.


So the first guess was correct! You have to take care to only use data in a thread-safe manner, which is again something I can't tell you how to do because it's partly Struts-specific.

Marco
Bear Bibeault
Author and ninkuma
Marshal

Joined: Jan 10, 2002
Posts: 61456
    
  67

Originally posted by Kim Kantola:
would this be an example of what you mean that could be causing me woes ?



Yes!

Your instance variables are being shared across threads. Get rid of them!
[ June 03, 2008: Message edited by: Bear Bibeault ]
Kim Kantola
Ranch Hand

Joined: May 17, 2001
Posts: 274
As us ranchers like to say , "Holy Sheep!".

That was it!
I removed them and the problem went away. I would have never thought of that.

Thanks again a million.

Java Ranch is the best.
Bear Bibeault
Author and ninkuma
Marshal

Joined: Jan 10, 2002
Posts: 61456
    
  67

Cool. It's very very important to keep your servlets/actions thread-safe.
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: Is the HttpSession per Tomcat session or per client?