Question

In PHP when a user logs into her account, I do the following in order to remember the user as she navigates through the site:

session_start();
...
$_SESSION['username'] = $username;

On any other page that may require sensitive data, I check that $_SESSION['username'] is valid.

When a use logs out, I do the following

unset($_SESSION['username']
session_destroy();

How do I do the same thing in Java? I have a REST API which uses Jersey and EJB. In case the following is important, I am persisting with JPA, Hibernate, Glassfish, and mysql.

UPDATED FOR VERIFICATON:

Is this correct?

@Path("login")
public class UserLoginResource {

  @EJB
  private LoginDao  loginDao;

  @Context
  HttpServletRequest request;

  @POST
  public Response login(JAXBElement<Login> jaxbLogin){
    Login login = jaxbLogin.getValue();
    loginDao.authenticateUserLogin(login);
    HttpSession session = request.getSession();
    session.setAttribute("username", login.getUsername());
    return Response.ok().build();
  }
}

Answer 1

Java is very different from php, so in java You will get session from only HttpRequest ‘s getSession() method, In php it is all time assumed, your code is run by some server(ie apache), In java, you will obtain it from ServletContainer(ie Apache Tomcat).

You do not have to start session in java unlike php, As long as you are in servlet container and giving request, for this client servlet container is responsible to start if there is not session for it

So for above actions:

    reqest.getSession().setAttribute("udername","Elbek");
    //later 
    reqest.getSession().removeAttribute("udername");

   //destroy it
   reqest.getSession().invalidate();

Here request is object of HttpRequest class

You may have a look to this HttpSession

I strongly recommend you to have a look java scopes

There is not this kind of thing in php, I wish there is, BUT there is NO

Here is how you get request object into your jersey action(method), ie by injecting @Context HttpServletRequest httpRequest

EDIT:
You do not create HttpRequest object by yourself, Instead you will get it from servlet container, Your server creates it from clients request and gives for your.