I am reading about HttpSession interface and I am not sure if I understand session expiry correct. Please correct me if I am wrong in this rough case example scenario:
- The client visits website and on the server side I need to create session (it is not created automatically by default as far as I understand) by calling
HttpServeltRequest.getSession()
. - After that
HttpSession
object is createdJSSESIONID
associated with this object is sent as a cookie withHttpServletResponse
- Next time user sends
HttpServletRequest
it will have that cookie withJSSESSIONID
attached. HttpSession
object get's destroyed after some inactivity set byHttpSession.setMaxInactiveInterval()
I have few questions:
- Am I correct assuming that calling
HttpServletRequest.getSession()
checks if there is a cookie withJSSESSIONID
received with request and it's value used to check if there is aHttpSession
object stored in servlet and if not newHttpSession
object is created and id attached a cookie? - Do I need to explicitly call
HttpServletRequest.getSession()
to keep session alive or does servlet automatically check on every request if there is aJSSESSIONID
received and updates last accessed time ofHttpSession
object?