浏览器访问服务器直至一方断开为一次会话,包括多个请求响应。
会话跟踪:判断多次请求是否同一浏览器,以便共享数据。
cookie数据存放浏览器(响应头Set-Cookie:key=value,),每次请求携带cookie访问服务器。
session共享数据存服务器。
cookie最大3k,session无限制。cookie放浏览器不安全,session放服务器安全。
Cookie
服务器向浏览器存cookie
pom引入Servlet、JSP、JSTL、Standard坐标和Tomcat7的插件plugin
@WebServlet("/aServlet")
public class AServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
Cookie nameCookie = new Cookie("name","zhangsan");
String englishTeacher = "王五";//cookie存中文需要转码为URL格式编码
englishTeacher = URLEncoder.encode(englishTeacher,"UTF-8");
Cookie englishTeacherCookie = new Cookie("englishTeacher", englishTeacher);
//nameCookie.setMaxAge(60*60*24*7);//设置cookie最大存放时间
resp.addCookie(nameCookie);
resp.addCookie(englishTeacherCookie);
}
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
doGet(req,resp);
}
}
访问结果:响应头Set-Cookie:name=zhangsan Set-Cookie:englishTeacher=%E9%90
浏览器携带cookie请求服务器
@WebServlet("/bServlet")
public class BServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
Cookie[] cookies = req.getCookies();
for (Cookie cookie:cookies) {
String name = cookie.getName();
if ("name".equals(name)){
String value = cookie.getValue();
System.out.println(name+":"+value);
}
if("englishTeacher".equals(cookie.getName())){
String value = cookie.getValue();
value = URLDecoder.decode(value,"UTF-8");
System.out.println(name+":"+value);
}
}
}
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
doGet(req,resp);
}
}
访问结果:请求头里Cookie:name=zhangsan; englishTeacher=%E9%90%9C%E5%AC;
Session
session是基于cookie,第一次session.setAttribute会向浏览器响应头设置set-cookie:JESSIONID=xx的属性。之后浏览器会携带请求头cookie:JESSIONID=xx
服务器正常关闭session会钝化写入硬盘,再次启动服务器session会活化。
默认服务器session30分钟销毁(见tomcat的conf/web.xml)。我们可调用session.invalidate()直接销毁session,也可在webapp的WEB-INFO的web.xml中进行配置session存放时间:
<session-config>
<session-timeout>100</session-timeout>
</session-config>
@WebServlet("/aSessionServlet")
public class ASessionServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
HttpSession session = req.getSession();
session.setAttribute("name","zhangsan");
session.setAttribute("password","zhangsan123");
session.setAttribute("englishTeacher","王五");
}
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
doGet(req,resp);
}
}
@WebServlet("/bSessionServlet")
public class BSessionServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
HttpSession session = req.getSession();
Object name = session.getAttribute("name");
session.removeAttribute("password");
Object password = session.getAttribute("password");
Object englishTeacher = session.getAttribute("englishTeacher");
System.out.println(name);
System.out.println(password);
System.out.println(englishTeacher);
}
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
doGet(req,resp);
}
}
使用场景
cookie:购物车、记住我功能
session:登陆后上栏用户名回显、登录图片验证码