Working with sessions in GWT application

Question

I have a GWT application that has RPC service on its back end. I'm currently trying to implement users support and the only question that still remains is the way I should store session data.

I'm storing session id using

getThreadLocalRequest().getSession().setAttribute("sid", "randomSIDgoeshere");

So, the first question is more to Java servlets than to GWT. Does this code guarantee that next time I make a call like this:

getThreadLocalRequest().getSession().getAttribute("sid");

It would either be null (in case it gets called for the user that hasn't yet visited the piece of code where SID attribute is set) or it would exactly the same SID I've already save for that user. In other words, are these 2 pieces of code user-specific? (by user I mean single browser on a single computer)

The second question is about storing the mappings between SIDs and some extra data like user id. In case I have a code like this:

public class MyGwtServiceImpl extends RemoteServiceServlet implements MyGwtService {
  // SID to User ID mappings
  private final Map<String, String> sessions = 
    new HashMap<String, String>();
  ...
}

Is it guaranteed that sessions is always the same object for all requests and its data will remain "alive" unless the whole application is terminated? (Tomcat is stopped for instance) Is it normal approach or I should persist all these mappings on my DB?

Answer 1

First:

Yes, it does guarantee. The next time you call getThreadLocalRequest().getSession().getAttribute("sid"); on the next request, the attribute sid will stay there. But remember, that's the local request area, thus only requests from the same user (browser + ip) shall share the information. That means:

Fact:

• User A connects with Firefox
• You store a random value X with the ID Y

Case 1

• User A connects with Firefox
• You can retrieve the X

Case 2

• User A connects with Google Chrome
• You cannot retrieve the value X

Case 3

• User B connects with Firefox
• You cannot retrieve the value X

So yes, the session's content is user-specific. What exists in one session does not imply that will exist in other session.

Second:

No, it is not guaranteed. Although most of the times the same servelet isntance will be called, it is not guaranteed that will always exist. If you want to persist with attributes in your servelet, you must declare those attributes as Static, and by so, THAT static attribute won't be user-specific. Or you can store in the ServeletContext

I say this because different implementations (like Glassfish) can terminate instances if the servelet isn't being required for a long period of time (as far as I remember, I'm not sure of this (Glassfish terminating the instance)). But there is no documentation saying that it does guarantee that will be the same instance, so you cannot declare non-static attributes and share between diferent instances.