Question

How to get any http session by id or all currently active http sessions within web application (Java 2 EE) in an elegant way?

Currently I have a WebSessionListener and once session was created I put it in ConcurrentHashMap() (map.put(sessionId, sessionObj)), everything ok, I can retrieve HTTP session from that map in any time by session id, but it looks like the HttpSession objects will never finalize… Even session was invalidated the map still reference on invalidated session object… Also I have read this article and it looks like the WeakHashMap is not acceptable in my case…

In other words I need a possiblity to look in any HttpSession even get all currently active HttpSession and retrieve some attributes from there…

Please advice somebody 🙂

Update

I need to access HttpSession objects because of follwoing reason:

Sometimes user does some actions/requests that may impact the work of another concurrent user, for example admin should disable user account but this user currently working with the system, in this case I need to show a message to admin e.g. “user XXX is currently working with the system” hence I need to check if any HttpSession which holds credentials of user XXX already exists and active. So this is whay I need such possibility to get any http session or even all sessions.

My current implementation is: SessionManager which knows about all sessions (ConcurrentMap) and HttpSessionListener which put/remove session into SessionManager.

I was concerned about memory issues that may occure and I wanted to discusse this with someone, but currently I am clearly see that everything should works fine because all invalidated session will be removed from map when sessionDestroyed() method will be called…

Many thanks for your replays, but now I understood that problem was just imagination 🙂

Answer 1

As per your clarification:

Sometimes user does some actions/requests that may impact the work of another concurrent user, for example admin should disable user account but this user currently working with the system, in this case I need to show a message to admin e.g. “user XXX is currently working with the system” hence I need to check if any HttpSession which holds credentials of user XXX already exists and active. So this is whay I need such possibility to get any http session or even all sessions.

For this you actually don’t need to know anything about the sessions. You just need to know which users are logged in. For that you can perfectly let the model object representing the logged in user implement HttpSessionBindingListener. I of course assume that you’re following the normal idiom to login/logout user by setting/removing the User model as a session attribute.

public class User implements HttpSessionBindingListener {

    @Override
    public void valueBound(HttpSessionBindingEvent event) {
        Set<User> logins = (Set<User>) event.getSession().getServletContext().getAttribute("logins");
        logins.add(this);
    }

    @Override
    public void valueUnbound(HttpSessionBindingEvent event) {
        Set<User> logins = (Set<User>) event.getSession().getServletContext().getAttribute("logins");
        logins.remove(this);
    }

    // @Override equals() and hashCode() as well!

}

Then somewhere in your admin app, just obtain the logins from ServletContext:

Set<User> logins = (Set<User>) servletContext.getAttribute("logins");