Best option for Session management in Java
cookies, java, servlets, session, url-rewriting
Solution
The session management (client identification, cookie handling, saving session scoped data and so on) is basically already done by the appserver itself. You don't need to worry about it at all. You can just set/get Java objects in the session by `HttpSession#setAttribute()` and `#getAttribute()`. Only thing what you really need to take care of is the URL rewriting for the case that the client doesn't support cookies. It will then append a `jsessionid` identifier to the URL. In the JSP you can use the JSTL's `c:url` for this. In the Servlet you can use `HttpServletResponse#encodeURL()` for this. This way the server can identify the client by reading the new request URL.
Your new question shall probably be "But how are cookies related to this? How does the server do it all?". Well, the answer is this: if the server receives a request from a client and the server side code (your code) is trying to get the `HttpSession` by `HttpServletRequest#getSession()` while there's no one created yet (first request in a fresh session), the server will create a new one itself. The server will generate a long, unique and hard-to-guess ID (the one which you can get by `HttpSession#getId()`) and set this ID as a value of the cookie with the name `jsessionid`. Under the hood the server uses `HttpServletResponse#addCookie()` for this. Finally the server will store all sessions in some kind of `Map` with the session ID as key and the `HttpSession` as value.
According to the HTTP cookie spec the client is required to send the same cookies back in the headers of the subsequent request. Under the hood the server will search for the `jsessionid` cookie by `HttpServletRequest#getCookies()` and determine its value. This way the server is able to obtain the associated `HttpSession` and give it back by every call on `HttpServletRequest#getSession()`.
To the point: the only thing which is stored in the client side is the session ID (in flavor of a cookie) and the `HttpSession` object (including all of its attributes) is stored in the server side (in Java's memory). You don't need to worry about session management youself and you also don't need to worry about the security.
See also:
- Authenticating the username, password by using filters in Java (contacting with database)
- How to redirect to Login page when Session is expired in Java web application?
- How to implement "Stay Logged In" when user login in to the web application
Problem
Best way managing session in Java. I heard that cookies are not reliable option for this as they gets stored into browser and can be accessed later on? Is this correct? If possible please come up with the answers with the coding example. Which is the best among: - URL Rewriting: Server will add an additional parameter at the end of URL link - Hidden parameter in Form: server will add an additional parameter at every form in HTML - cookie: Server will ask browser to maintain a cookie.