Managing sessions using HttpSession in Jakarta Servlets is a straightforward process. HttpSession is a part of the Jakarta Servlet API which provides a way to handle session management between a client and server during multiple requests.

Here’s a structured guide on using and managing sessions with HttpSession:

---

1. Introduction to HttpSession

• The HttpSession interface is used to:
  • Store information about a user’s session (attributes such as user information, preferences, or data specific to each client).
  • Track users across multiple requests (via cookies or URL rewriting).

---

2. How to Create or Retrieve a Session

You can retrieve or create a session using the HttpServletRequest.getSession() method:

HttpSession session = request.getSession();

• If a session already exists, this method returns the existing session.
• If no session exists, it will create a new one.

If you want to retrieve the session but don’t want to create a new one if it does not exist, you can use:

HttpSession session = request.getSession(false); // Returns null if no session exists

---

3. Adding Attributes to the Session

You can store user-related or application-specific data in the session using the setAttribute method:

session.setAttribute("user", "JohnDoe");
session.setAttribute("cartItems", cartItemList);

4. Retrieving Attributes from the Session

Use the getAttribute method to retrieve values stored in the session:

String user = (String) session.getAttribute("user");
List<String> cartItems = (List<String>) session.getAttribute("cartItems");

Make sure to cast the returned object to the proper type.

---

5. Removing Attributes from the Session

Use the removeAttribute method to delete specific session attributes:

session.removeAttribute("user");

---

6. Invalidating or Destroying the Session

When the session is no longer needed (e.g., a user logs out), you can invalidate the session using:

session.invalidate();

This method:

1. Invalidates the current session and removes all the stored attributes.
2. Creates a new session on the next request.getSession() call.

---

7. Setting Session Timeout

You can specify the session timeout (in minutes) using:

session.setMaxInactiveInterval(30 * 60); // 30 minutes

To retrieve the current session timeout:

int timeout = session.getMaxInactiveInterval();

If the user is inactive for longer than the timeout duration, the session will be invalidated automatically.

---

8. Session ID

Each HttpSession has a unique session ID. You can retrieve it using:

String sessionId = session.getId();

This ID is used to track the session between requests (usually via cookies or URL rewriting).

---

9. Checking Session Validity

You can verify whether a session is new using:

boolean isNew = session.isNew();

This is particularly useful when you want to check if the session was newly created or reused.

---

10. Session Tracking Mechanisms

The server manages session tracking using one of the following mechanisms:

1. Cookies: This is the default method where the session ID is maintained using a cookie (e.g., JSESSIONID).
2. URL Rewriting: This is a fallback mechanism when cookies are disabled. The session ID is appended to the URL as a query parameter.

For enabling URL rewriting, you can use:

String encodedURL = response.encodeURL("yourUrlHere");

This ensures the session ID is included in the URL if cookies are not supported.

---

11. Example Code: Using HttpSession

Here’s a full working example:

package org.kodejava.servlet;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import java.io.IOException;

@WebServlet("/sessionExample")
public class SessionExampleServlet extends HttpServlet {

  @Override
  protected void doGet(HttpServletRequest request, HttpServletResponse response)
          throws ServletException, IOException {
    // Retrieve session, create if none exists
    HttpSession session = request.getSession();

    // Set session attributes
    session.setAttribute("username", "JohnDoe");

    // Get session attributes
    String username = (String) session.getAttribute("username");

    // Display session info
    response.setContentType("text/html");
    response.getWriter().println("<h1>Welcome, " + username + "</h1>");

    // Show session ID
    response.getWriter().println("<p>Session ID: " + session.getId() + "</p>");
  }

  @Override
  protected void doPost(HttpServletRequest request, HttpServletResponse response)
          throws ServletException, IOException {
    // Invalidate session on logout
    HttpSession session = request.getSession(false);
    if (session != null) {
      session.invalidate();
    }
    response.getWriter().write("Logged out successfully!");
  }
}

---

12. Best Practices for HttpSession

• Minimize Data Storage: Store only necessary, lightweight data in the session to reduce memory overhead.
• Secure Session Handling:
  • Ensure cookies are marked as HttpOnly and Secure.
  • Implement proper session timeout.
  • Use HTTPS to protect the session ID during transmission.
• Invalidate Sessions on Logout: Always invalidate the session to clear sensitive data when users log out.

---

By following these steps, you can effectively manage user sessions using HttpSession in your Jakarta Servlets-based application.

Maven dependencies

<dependency>
    <groupId>jakarta.servlet</groupId>
    <artifactId>jakarta.servlet-api</artifactId>
    <version>6.1.0</version>
    <scope>provided</scope>
</dependency>