Let's say I have a running Java-based web application with 0 or more valid HttpSession
objects associated with it. I want a way to access the current list of valid HttpSession
objects. I was thinking that I could implement an HttpSessionListener
and use it to append to a list of session id values that are stored in an application-scoped attribute, but then I'm on the hook to update the list as sessions are invalidated and who knows what else.
Before I start baking my own solution I thought I should ask the question:
Does the servlet API provide some means of getting access to the complete list of non-invalidated session objects?
I am using Tomcat 6.x as my web application container, and the MyFaces 1.2.x (JSF) library.
SOLUTION
I followed an approach similar to what BalusC discussed in these existing questions:
I modified by SessionData
class to implement HttpSessionBindingListener
. When a binding event happens, the object will either add or remove itself from the set of all the SessionData
objects.
@Override
public void valueBound(HttpSessionBindingEvent event) {
// Get my custom application-scoped attribute
ApplicationData applicationData = getApplicationData();
// Get the set of all SessionData objects and add myself to it
Set<SessionData> activeSessions = applicationData.getActiveSessions();
if (!activeSessions.contains(this)) {
activeSessions.add(this);
}
}
@Override
public void valueUnbound(HttpSessionBindingEvent event) {
HttpSession session = event.getSession();
ApplicationData applicationData = getApplicationData();
Set<SessionData> activeSessions = applicationData.getActiveSessions();
if (activeSessions.contains(this)) {
activeSessions.remove(this);
}
}
The one thing that continues to irritate me is what happens when Tomcat is restarted. Unless Tomcat has been properly configured to NOT serialize sessions to disk, it will do so. When Tomcat starts up again, the HttpSession
objects (and the SessionData
objects along with them) are deserialized and the sessions are made valid again. However, the serialization/deserialization totally sidesteps the HttpSession
listener events, so I do not have the opportunity to gracefully put the deserialized reference to the SessionData
back in my managed Set of objects after the restart.
I don't have any control over the production configuration of Tomcat in my customer's organization, so I cannot assume that it will be done the way I expect it.
My workaround is to compare the HttpSession
creation time with the application startup time when a request is received. If the session was created before the application startup time, then I call invalidate()
and the user is sent to an error/warning page with an explanation of what happened.
I get the application startup time by implementing a ServletContextListener
and storing the current time inside an application-scoped object from within the contextInitialized()
method of my listener.
No, the Servlet API doesn't provide a way. You really have to get hold of them all with help of a HttpSessionListener
. You can find several examples in the following answers: