Professional Java Servlets 2.3

The fact that HTTP is a "stateless protocol" has important consequences when we communicate with web applications via HTTP. In the introduction to this chapter, we discussed one scenario where we need to maintain state, the shopping cart application. Consider another scenario:

• Typical online banking can involve one or more banking transactions. Most such transactions may spawn across several pages. In order to maintain the transactions, we need a mechanism to uniquely identify the user, to track the activity of the user within the site, and to relate the transactions to the account/transaction data stored in backend systems.

In both scenarios we mentioned above there are two important activities:

• Tracking the identity of a user

  As the user makes multiple requests to the same web application over a period of time, we need a mechanism that links these requests together. Effectively, this means that we need to associate each request with a client identifier, so that we can identify requests from the same user.

• Maintaining user state

  Since there is often data associated with each request, we will need a way to associate the request data with the user that made the request, and a way to preserve that data across requests.

The ability to associate a request with the client that made the request is known as maintaining a session. However, the obvious next question to ask is: what mechanisms can we use to maintain sessions?