Managing Sessions with Tomcat and Cookies

Question

I find it hard to understand how Tomcat handles cookies and backstage session management.

When or where does Tomcat issue cookies to control HttpSession ? According to this question / answer , sessions are created from the initial call to getSession() .

If I run Filter and call getSession() , does it automatically attach the necessary cookie (provided that I configured web.xml to use cookies) in ServletResponse ? If not, how do I do this? I do not start jsp.

Answer 1

Java Servlets manages cookies and is transparent to you, under the hood. Tomcat is a web server running Java servlets.

How web servers manage cookies, they send them directly to an HTTP request, I’m not 100% sure of the protocol text, but I believe that just Tomcat will send “SET COOKIE: ...” to the actual HTTP that is sent to your browser.

It is important to note that Tomcat and the java servlet specification are related - Tomcat hosts servlets and provides interface implementations that wrap basic aspects of HTTP communication: for example, here is its Cookie interface ---- http://tomcat.apache.org/tomcat-5.5 -doc / servletapi / javax / servlet / http / Cookie.html .

In general, this should not cause much concern when writing a web application, unless you are doing something unusual. It is assumed that the Servlet api can abstract this by giving you access to the session API, which allows you to set / receive objects specific to the client you are dealing with.