Class StandardSession
- All Implemented Interfaces:
Serializable
,HttpSession
,Session
- Direct Known Subclasses:
DeltaSession
IMPLEMENTATION NOTE: An instance of this class represents both the internal (Session) and application level
(HttpSession) view of the session. However, because the class itself is not declared public, Java logic outside of
the org.apache.catalina.session
package cannot cast an HttpSession view of this instance back to a
Session view.
IMPLEMENTATION NOTE: If you add fields to this class, you must make sure that you carry them over in the read/writeObject methods so that this class is properly serialized.
- Author:
- Craig R. McClanahan, Sean Legassick, Jon S. Stevens
- See Also:
-
Field Summary
Modifier and TypeFieldDescriptionprotected AtomicInteger
The access count for this session.protected static final boolean
protected ConcurrentMap<String,
Object> The collection of user data attributes associated with this Session.protected String
The authentication type used to authenticate our cached Principal, if any.protected long
The time this session was created, in milliseconds since midnight, January 1, 1970 GMT.protected static final String[]
Type array.protected boolean
We are currently processing a session expiration, so bypass certain IllegalStateException tests.protected StandardSessionFacade
The facade associated with this session.protected String
The session identifier of this Session.protected boolean
Flag indicating whether this session is new or not.protected boolean
Flag indicating whether this session is valid or not.protected static final boolean
protected long
The last accessed time for this Session.protected ArrayList<SessionListener>
The session event listeners for this Session.protected Manager
The Manager with which this Session is associated.protected int
The maximum time interval, in seconds, between client requests before the servlet container may invalidate this session.Internal notes associated with this session by Catalina components and event listeners.protected Principal
The authenticated Principal associated with this session, if any.protected static HttpSessionContext
Deprecated.protected static final StringManager
The string manager for this package.protected static final boolean
protected final PropertyChangeSupport
The property change support for this component.protected long
The current accessed time for this session.Fields inherited from interface org.apache.catalina.Session
SESSION_ACTIVATED_EVENT, SESSION_CREATED_EVENT, SESSION_DESTROYED_EVENT, SESSION_PASSIVATED_EVENT
-
Constructor Summary
ConstructorDescriptionStandardSession
(Manager manager) Construct a new Session associated with the specified Manager. -
Method Summary
Modifier and TypeMethodDescriptionvoid
access()
Update the accessed time information for this session.void
activate()
Perform internal processing required to activate this session.void
addSessionListener
(SessionListener listener) Add a session event listener to this component.protected void
doReadObject
(ObjectInputStream stream) Read a serialized version of this session object from the specified object input stream.protected void
doWriteObject
(ObjectOutputStream stream) Write a serialized version of this session object to the specified object output stream.void
End access to the session.protected boolean
Should the given session attribute be excluded?void
expire()
Perform the internal processing required to invalidate this session, without triggering an exception if the session has already expired.void
expire
(boolean notify) Perform the internal processing required to invalidate this session, without triggering an exception if the session has already expired.void
fireSessionEvent
(String type, Object data) Notify all session event listeners that a particular event has occurred for this Session.getAttribute
(String name) Returns the object bound with the specified name in this session, ornull
if no object is bound under the name.Returns anEnumeration
ofString
objects containing the names of all the objects bound to this session.long
Returns the time when this session was created, measured in milliseconds since midnight January 1, 1970 GMT.long
getId()
Returns a string containing the unique identifier assigned to this session.long
long
long
Returns the last time the client sent a request associated with this session, as the number of milliseconds since midnight January 1, 1970 GMT, and marked by the time the container received the request.long
int
Returns the maximum time interval, in seconds, that the servlet container will keep this session open between client accesses.Returns the ServletContext to which this session belongs.Deprecated.As of Version 2.1, this method is deprecated and has no replacement.long
long
Deprecated.String[]
Deprecated.void
Invalidates this session then unbinds any objects bound to it.boolean
isAttributeDistributable
(String name, Object value) Does the session implementation support the distributing of the given attribute?boolean
isNew()
Returnstrue
if the client does not yet know about the session or if the client chooses not to join the session.boolean
isValid()
protected boolean
protected String[]
keys()
void
Perform the internal processing required to passivate this session.void
Deprecated.void
readObjectData
(ObjectInputStream stream) Read a serialized version of the contents of this session object from the specified object input stream, without requiring that the StandardSession itself have been serialized.void
recycle()
Release all object references, and initialize instance variables, in preparation for reuse of this object.void
removeAttribute
(String name) Removes the object bound with the specified name from this session.void
removeAttribute
(String name, boolean notify) Remove the object bound with the specified name from this session.protected void
removeAttributeInternal
(String name, boolean notify) Remove the object bound with the specified name from this session.void
removeNote
(String name) Remove any object bound to the specified name in the internal notes for this session.void
removeSessionListener
(SessionListener listener) Remove a session event listener from this component.void
removeValue
(String name) Deprecated.void
setAttribute
(String name, Object value) Binds an object to this session, using the name specified.void
setAttribute
(String name, Object value, boolean notify) Bind an object to this session, using the specified name.void
setAuthType
(String authType) Set the authentication type used to authenticate our cached Principal, if any.void
setCreationTime
(long time) Set the creation time for this session.void
Set the session identifier for this session and notifies any associated listeners that a new session has been created.void
Set the session identifier for this session and optionally notifies any associated listeners that a new session has been created.void
setManager
(Manager manager) Set the Manager within which this Session is valid.void
setMaxInactiveInterval
(int interval) Specifies the time, in seconds, between client requests before the servlet container will invalidate this session.void
setNew
(boolean isNew) Set theisNew
flag for this session.void
Bind an object to a specified name in the internal notes associated with this session, replacing any existing binding for this name.void
setPrincipal
(Principal principal) Set the authenticated Principal that is associated with this Session.void
setValid
(boolean isValid) Set theisValid
flag for this session.void
tellChangedSessionId
(String newId, String oldId, boolean notifySessionListeners, boolean notifyContainerListeners) Inform the listeners about the change session ID.void
tellNew()
Inform the listeners about the new session.toString()
void
writeObjectData
(ObjectOutputStream stream) Write a serialized version of the contents of this session object to the specified object output stream, without requiring that the StandardSession itself have been serialized.
-
Field Details
-
STRICT_SERVLET_COMPLIANCE
protected static final boolean STRICT_SERVLET_COMPLIANCE -
ACTIVITY_CHECK
protected static final boolean ACTIVITY_CHECK -
LAST_ACCESS_AT_START
protected static final boolean LAST_ACCESS_AT_START -
EMPTY_ARRAY
Type array. -
attributes
The collection of user data attributes associated with this Session. -
authType
The authentication type used to authenticate our cached Principal, if any. NOTE: This value is not included in the serialized version of this object. -
creationTime
protected long creationTimeThe time this session was created, in milliseconds since midnight, January 1, 1970 GMT. -
expiring
protected transient volatile boolean expiringWe are currently processing a session expiration, so bypass certain IllegalStateException tests. NOTE: This value is not included in the serialized version of this object. -
facade
The facade associated with this session. NOTE: This value is not included in the serialized version of this object. -
id
The session identifier of this Session. -
lastAccessedTime
protected volatile long lastAccessedTimeThe last accessed time for this Session. -
listeners
The session event listeners for this Session. -
manager
The Manager with which this Session is associated. -
maxInactiveInterval
protected volatile int maxInactiveIntervalThe maximum time interval, in seconds, between client requests before the servlet container may invalidate this session. A negative time indicates that the session should never time out. -
isNew
protected volatile boolean isNewFlag indicating whether this session is new or not. -
isValid
protected volatile boolean isValidFlag indicating whether this session is valid or not. -
notes
Internal notes associated with this session by Catalina components and event listeners. IMPLEMENTATION NOTE: This object is not saved and restored across session serializations! -
principal
The authenticated Principal associated with this session, if any. IMPLEMENTATION NOTE: This object is not saved and restored across session serializations! -
sm
The string manager for this package. -
sessionContext
Deprecated.The HTTP session context associated with this session. -
support
The property change support for this component. NOTE: This value is not included in the serialized version of this object. -
thisAccessedTime
protected volatile long thisAccessedTimeThe current accessed time for this session. -
accessCount
The access count for this session.
-
-
Constructor Details
-
StandardSession
Construct a new Session associated with the specified Manager.- Parameters:
manager
- The manager with which this Session is associated
-
-
Method Details
-
getAuthType
- Specified by:
getAuthType
in interfaceSession
- Returns:
- the authentication type used to authenticate our cached Principal, if any.
-
setAuthType
Description copied from interface:Session
Set the authentication type used to authenticate our cached Principal, if any.- Specified by:
setAuthType
in interfaceSession
- Parameters:
authType
- The new cached authentication type
-
setCreationTime
public void setCreationTime(long time) Description copied from interface:Session
Set the creation time for this session. This method is called by the Manager when an existing Session instance is reused.- Specified by:
setCreationTime
in interfaceSession
- Parameters:
time
- The new creation time
-
getId
Description copied from interface:javax.servlet.http.HttpSession
Returns a string containing the unique identifier assigned to this session. The identifier is assigned by the servlet container and is implementation dependent.- Specified by:
getId
in interfaceHttpSession
- Specified by:
getId
in interfaceSession
- Returns:
- a string specifying the identifier assigned to this session
-
getIdInternal
- Specified by:
getIdInternal
in interfaceSession
- Returns:
- the session identifier for this session.
-
setId
Description copied from interface:Session
Set the session identifier for this session and notifies any associated listeners that a new session has been created. -
setId
Description copied from interface:Session
Set the session identifier for this session and optionally notifies any associated listeners that a new session has been created. -
tellNew
public void tellNew()Inform the listeners about the new session. -
tellChangedSessionId
public void tellChangedSessionId(String newId, String oldId, boolean notifySessionListeners, boolean notifyContainerListeners) Description copied from interface:Session
Inform the listeners about the change session ID.- Specified by:
tellChangedSessionId
in interfaceSession
- Parameters:
newId
- new session IDoldId
- old session IDnotifySessionListeners
- Should any associated sessionListeners be notified that session ID has been changed?notifyContainerListeners
- Should any associated ContainerListeners be notified that session ID has been changed?
-
getThisAccessedTime
public long getThisAccessedTime()- Specified by:
getThisAccessedTime
in interfaceSession
- Returns:
- the last time the client sent a request associated with this session, as the number of milliseconds since midnight, January 1, 1970 GMT. Actions that your application takes, such as getting or setting a value associated with the session, do not affect the access time. This one gets updated whenever a request starts.
-
getThisAccessedTimeInternal
public long getThisAccessedTimeInternal()- Specified by:
getThisAccessedTimeInternal
in interfaceSession
- Returns:
- the last client access time without invalidation check
- See Also:
-
getLastAccessedTime
public long getLastAccessedTime()Description copied from interface:javax.servlet.http.HttpSession
Returns the last time the client sent a request associated with this session, as the number of milliseconds since midnight January 1, 1970 GMT, and marked by the time the container received the request.Actions that your application takes, such as getting or setting a value associated with the session, do not affect the access time.
- Specified by:
getLastAccessedTime
in interfaceHttpSession
- Specified by:
getLastAccessedTime
in interfaceSession
- Returns:
- a
long
representing the last time the client sent a request associated with this session, expressed in milliseconds since 1/1/1970 GMT
-
getLastAccessedTimeInternal
public long getLastAccessedTimeInternal()- Specified by:
getLastAccessedTimeInternal
in interfaceSession
- Returns:
- the last client access time without invalidation check
- See Also:
-
getIdleTime
public long getIdleTime()- Specified by:
getIdleTime
in interfaceSession
- Returns:
- the idle time (in milliseconds) from last client access time.
-
getIdleTimeInternal
public long getIdleTimeInternal()- Specified by:
getIdleTimeInternal
in interfaceSession
- Returns:
- the idle time from last client access time without invalidation check
- See Also:
-
getManager
- Specified by:
getManager
in interfaceSession
- Returns:
- the Manager within which this Session is valid.
-
setManager
Description copied from interface:Session
Set the Manager within which this Session is valid.- Specified by:
setManager
in interfaceSession
- Parameters:
manager
- The new Manager
-
getMaxInactiveInterval
public int getMaxInactiveInterval()Description copied from interface:javax.servlet.http.HttpSession
Returns the maximum time interval, in seconds, that the servlet container will keep this session open between client accesses. After this interval, the servlet container will invalidate the session. The maximum time interval can be set with thesetMaxInactiveInterval
method. A zero or negative time indicates that the session should never timeout.- Specified by:
getMaxInactiveInterval
in interfaceHttpSession
- Specified by:
getMaxInactiveInterval
in interfaceSession
- Returns:
- an integer specifying the number of seconds this session remains open between client requests
- See Also:
-
setMaxInactiveInterval
public void setMaxInactiveInterval(int interval) Description copied from interface:javax.servlet.http.HttpSession
Specifies the time, in seconds, between client requests before the servlet container will invalidate this session. A zero or negative time indicates that the session should never timeout.- Specified by:
setMaxInactiveInterval
in interfaceHttpSession
- Specified by:
setMaxInactiveInterval
in interfaceSession
- Parameters:
interval
- An integer specifying the number of seconds
-
setNew
public void setNew(boolean isNew) Description copied from interface:Session
Set theisNew
flag for this session. -
getPrincipal
- Specified by:
getPrincipal
in interfaceSession
- Returns:
- the authenticated Principal that is associated with this Session. This provides an
Authenticator
with a means to cache a previously authenticated Principal, and avoid potentially expensiveRealm.authenticate()
calls on every request. If there is no current associated Principal, returnnull
.
-
setPrincipal
Description copied from interface:Session
Set the authenticated Principal that is associated with this Session. This provides anAuthenticator
with a means to cache a previously authenticated Principal, and avoid potentially expensiveRealm.authenticate()
calls on every request.- Specified by:
setPrincipal
in interfaceSession
- Parameters:
principal
- The new Principal, ornull
if none
-
getSession
- Specified by:
getSession
in interfaceSession
- Returns:
- the
HttpSession
for which this object is the facade.
-
isValid
public boolean isValid() -
setValid
public void setValid(boolean isValid) Description copied from interface:Session
Set theisValid
flag for this session. -
access
public void access()Description copied from interface:Session
Update the accessed time information for this session. This method should be called by the context when a request comes in for a particular session, even if the application does not reference it. -
endAccess
public void endAccess()Description copied from interface:Session
End access to the session. -
addSessionListener
Description copied from interface:Session
Add a session event listener to this component.- Specified by:
addSessionListener
in interfaceSession
- Parameters:
listener
- the SessionListener instance that should be notified for session events
-
expire
public void expire()Description copied from interface:Session
Perform the internal processing required to invalidate this session, without triggering an exception if the session has already expired. -
expire
public void expire(boolean notify) Perform the internal processing required to invalidate this session, without triggering an exception if the session has already expired.- Parameters:
notify
- Should we notify listeners about the demise of this session?
-
passivate
public void passivate()Perform the internal processing required to passivate this session. -
activate
public void activate()Perform internal processing required to activate this session. -
getNote
-
getNoteNames
- Specified by:
getNoteNames
in interfaceSession
- Returns:
- an Iterator containing the String names of all notes bindings that exist for this session.
-
recycle
public void recycle()Description copied from interface:Session
Release all object references, and initialize instance variables, in preparation for reuse of this object. -
removeNote
Description copied from interface:Session
Remove any object bound to the specified name in the internal notes for this session.- Specified by:
removeNote
in interfaceSession
- Parameters:
name
- Name of the note to be removed
-
removeSessionListener
Description copied from interface:Session
Remove a session event listener from this component.- Specified by:
removeSessionListener
in interfaceSession
- Parameters:
listener
- remove the session listener, which will no longer be notified
-
setNote
Description copied from interface:Session
Bind an object to a specified name in the internal notes associated with this session, replacing any existing binding for this name. -
toString
-
readObjectData
Read a serialized version of the contents of this session object from the specified object input stream, without requiring that the StandardSession itself have been serialized.- Parameters:
stream
- The object input stream to read from- Throws:
ClassNotFoundException
- if an unknown class is specifiedIOException
- if an input/output error occurs
-
writeObjectData
Write a serialized version of the contents of this session object to the specified object output stream, without requiring that the StandardSession itself have been serialized.- Parameters:
stream
- The object output stream to write to- Throws:
IOException
- if an input/output error occurs
-
getCreationTime
public long getCreationTime()Description copied from interface:javax.servlet.http.HttpSession
Returns the time when this session was created, measured in milliseconds since midnight January 1, 1970 GMT.- Specified by:
getCreationTime
in interfaceHttpSession
- Specified by:
getCreationTime
in interfaceSession
- Returns:
- a
long
specifying when this session was created, expressed in milliseconds since 1/1/1970 GMT
-
getCreationTimeInternal
public long getCreationTimeInternal()- Specified by:
getCreationTimeInternal
in interfaceSession
- Returns:
- the creation time for this session, bypassing the session validity checks.
-
getServletContext
Description copied from interface:javax.servlet.http.HttpSession
Returns the ServletContext to which this session belongs.- Specified by:
getServletContext
in interfaceHttpSession
- Returns:
- The ServletContext object for the web application
-
getSessionContext
Deprecated.As of Version 2.1, this method is deprecated and has no replacement. It will be removed in a future version of the Java Servlet API.Return the session context with which this session is associated.- Specified by:
getSessionContext
in interfaceHttpSession
- Returns:
- A dummy implementation of HttpSessionContext
-
getAttribute
Description copied from interface:javax.servlet.http.HttpSession
Returns the object bound with the specified name in this session, ornull
if no object is bound under the name.- Specified by:
getAttribute
in interfaceHttpSession
- Parameters:
name
- a string specifying the name of the object- Returns:
- the object with the specified name
-
getAttributeNames
Description copied from interface:javax.servlet.http.HttpSession
Returns anEnumeration
ofString
objects containing the names of all the objects bound to this session.- Specified by:
getAttributeNames
in interfaceHttpSession
- Returns:
- an
Enumeration
ofString
objects specifying the names of all the objects bound to this session
-
getValue
Deprecated.- Specified by:
getValue
in interfaceHttpSession
- Parameters:
name
- a string specifying the name of the object- Returns:
- the object with the specified name
-
getValueNames
Deprecated.- Specified by:
getValueNames
in interfaceHttpSession
- Returns:
- an array of
String
objects specifying the names of all the objects bound to this session
-
invalidate
public void invalidate()Description copied from interface:javax.servlet.http.HttpSession
Invalidates this session then unbinds any objects bound to it.- Specified by:
invalidate
in interfaceHttpSession
-
isNew
public boolean isNew()Description copied from interface:javax.servlet.http.HttpSession
Returnstrue
if the client does not yet know about the session or if the client chooses not to join the session. For example, if the server used only cookie-based sessions, and the client had disabled the use of cookies, then a session would be new on each request.- Specified by:
isNew
in interfaceHttpSession
- Returns:
true
if the server has created a session, but the client has not yet joined
-
putValue
Deprecated.- Specified by:
putValue
in interfaceHttpSession
- Parameters:
name
- the name to which the object is bound; cannot be nullvalue
- the object to be bound; cannot be null
-
removeAttribute
Description copied from interface:javax.servlet.http.HttpSession
Removes the object bound with the specified name from this session. If the session does not have an object bound with the specified name, this method does nothing.After this method executes, and if the object implements
HttpSessionBindingListener
, the container callsHttpSessionBindingListener.valueUnbound
. The container then notifies anyHttpSessionAttributeListener
s in the web application.- Specified by:
removeAttribute
in interfaceHttpSession
- Parameters:
name
- the name of the object to remove from this session
-
removeAttribute
Remove the object bound with the specified name from this session. If the session does not have an object bound with this name, this method does nothing.After this method executes, and if the object implements
HttpSessionBindingListener
, the container callsvalueUnbound()
on the object.- Parameters:
name
- Name of the object to remove from this session.notify
- Should we notify interested listeners that this attribute is being removed?- Throws:
IllegalStateException
- if this method is called on an invalidated session
-
removeValue
Deprecated.- Specified by:
removeValue
in interfaceHttpSession
- Parameters:
name
- the name of the object to remove from this session
-
setAttribute
Description copied from interface:javax.servlet.http.HttpSession
Binds an object to this session, using the name specified. If an object of the same name is already bound to the session, the object is replaced.After this method executes, and if the new object implements
HttpSessionBindingListener
, the container callsHttpSessionBindingListener.valueBound
. The container then notifies anyHttpSessionAttributeListener
s in the web application.If an object was already bound to this session of this name that implements
HttpSessionBindingListener
, itsHttpSessionBindingListener.valueUnbound
method is called.If the value passed in is null, this has the same effect as calling
removeAttribute()
.- Specified by:
setAttribute
in interfaceHttpSession
- Parameters:
name
- the name to which the object is bound; cannot be nullvalue
- the object to be bound
-
setAttribute
Bind an object to this session, using the specified name. If an object of the same name is already bound to this session, the object is replaced.After this method executes, and if the object implements
HttpSessionBindingListener
, the container callsvalueBound()
on the object.- Parameters:
name
- Name to which the object is bound, cannot be nullvalue
- Object to be bound, cannot be nullnotify
- whether to notify session listeners- Throws:
IllegalArgumentException
- if an attempt is made to add a non-serializable object in an environment marked distributable.IllegalStateException
- if this method is called on an invalidated session
-
isValidInternal
protected boolean isValidInternal()- Returns:
- the
isValid
flag for this session without any expiration check.
-
isAttributeDistributable
Does the session implementation support the distributing of the given attribute? If the Manager is marked as distributable, then this method must be used to check attributes before adding them to a session and anIllegalArgumentException
thrown if the proposed attribute is not distributable.Note that the
Manager
implementation may further restrict which attributes are distributed but aManager
level restriction should not trigger anIllegalArgumentException
inHttpSession.setAttribute(String, Object)
This implementation simply checks the value for serializability. Sub-classes might use other distribution technology not based on serialization and can override this check.
- Specified by:
isAttributeDistributable
in interfaceSession
- Parameters:
name
- The attribute namevalue
- The attribute value- Returns:
true
if distribution is supported, otherwisefalse
-
doReadObject
Read a serialized version of this session object from the specified object input stream.IMPLEMENTATION NOTE: The reference to the owning Manager is not restored by this method, and must be set explicitly.
- Parameters:
stream
- The input stream to read from- Throws:
ClassNotFoundException
- if an unknown class is specifiedIOException
- if an input/output error occurs
-
doWriteObject
Write a serialized version of this session object to the specified object output stream.IMPLEMENTATION NOTE: The owning Manager will not be stored in the serialized representation of this Session. After calling
readObject()
, you must set the associated Manager explicitly.IMPLEMENTATION NOTE: Any attribute that is not Serializable will be unbound from the session, with appropriate actions if it implements HttpSessionBindingListener. If you do not want any such attributes, be sure the
distributable
property of the associated Manager is set totrue
.- Parameters:
stream
- The output stream to write to- Throws:
IOException
- if an input/output error occurs
-
exclude
Should the given session attribute be excluded? This implementation checks: Note: This method deliberately does not checkisAttributeDistributable(String, Object)
which is kept separate to support the checks required insetAttribute(String, Object, boolean)
- Parameters:
name
- The attribute namevalue
- The attribute value- Returns:
true
if the attribute should be excluded from distribution, otherwisefalse
-
fireSessionEvent
Notify all session event listeners that a particular event has occurred for this Session. The default implementation performs this notification synchronously using the calling thread.- Parameters:
type
- Event typedata
- Event data
-
keys
- Returns:
- the names of all currently defined session attributes as an array of Strings. If there are no defined attributes, a zero-length array is returned.
-
removeAttributeInternal
Remove the object bound with the specified name from this session. If the session does not have an object bound with this name, this method does nothing.After this method executes, and if the object implements
HttpSessionBindingListener
, the container callsvalueUnbound()
on the object.- Parameters:
name
- Name of the object to remove from this session.notify
- Should we notify interested listeners that this attribute is being removed?
-