Re: concept of session in J2EE

Lew wrote:
Arne Vajhøj wrote:
That is up to the browser.

Let us assume sessions are maintained via cookies not URL
rewriting because cookies are by fat the most common.

When the session is established then the browser get a session
cookie from the server.

All requests coming with that session cookie belongs to that
session.

So it is up to the browser whether it will send the same
cookie for another window or not.

If I remember correct then IE and FF act differently regarding
this.

So be very conservative about what you assume.

You are correct - I just checked with FF and the second instance
does
indeed seem to be aware of the first one's session, or perhaps the
server is aware of my IP address and somehow uses that. Regardless,
both instances seem to share the session.

On Windows, at least, multiple Firefox windows are all part of the
same OS process. Multiple IE windows are different processes. This
matches the difference in session behavior.


.

Relevant Pages

  • Re: Is Session Always Cleared?
    ... If the first user closes his browser after he is finished, the session cookie is forgotten. ... I think that firefox uses the same cookieset for all it's windows. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Sessions vs Cookies
    ... There is a session cookie which simply allows the server to identify the client and retrieve relevant session data for it. ... If cookies can be read or forged, it makes little odds whether you have the master key or all the little keys,. ... Suppose you only send the PHPSESSID: Now you cannot change a thing on the server, even if you have the 'master key'. ...
    (comp.lang.php)
  • Re: using Session with FormsAuthentication
    ... For IE browser, it'll start a new session if we launch a new IE windows ... For cookie, there are generally two kinds of cookies: ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: session wont timeout
    ... Maybe this is a session cookie issue? ... client browser there is this one: WSS_KeepSessionAuthenticated Expires: At ... If I kill the session cookie using IE Developer Toolbar, ... possible and IIS would throw another challenge. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Is it safe to store user_id in Session?
    ... What I was wondering is how safe it is to store user_id or username or ... session so I do not need to search the database all the time. ... OVERRIDING BASIC SESSION COOKIE AUTHENTICATION ... So what is described in the article only works for bad php scripts. ...
    (comp.lang.php)