8.2.1. Servlet Session-Tracking API

public void doGet(HttpServletRequest req, HttpServletResponse res)
        throws ServletException, IOException {
    // retrieve an instance of HttpSession for this user. The "true" parameter
    // indicates that the object should be created if it does not exist.
    HttpSession session = req.getSession(true);

    // retrieve the cart for this user
    Cart cart = (Cart) session.getAttribute("shoppingCart");

    if (cart == null) {
        cart = new Cart( );
        session.setAttribute("shoppingCart", cart);
    }

    ...
}

The first line of the doGet( ) method locates the HttpSession instance associated with the current user. The true parameter indicates that a new session should be created if one does not already exist. Once the session is created, a Cart object can be retrieved using HttpSession's getAttribute( ) method.

Figure 8-3. Session tracking

Click on the link to move next:
<a href="/shopping/moveNext"/>Move Next</a>

This causes session tracking to fail, because the session identifier is lost whenever the user clicks on the hyperlink. We really want the HTML to look like this:

Click on the link to move next:
<a href="/shopping/moveNext;jsessionid=0e394s8a576f67b38s7"/>Move Next</a>

Now, when the user clicks on the hyperlink, the session identifier (jsessionid) is transmitted to the servlet as part of the requested URL.

String originalURL = "/shopping/moveNext";
String encodedURL = response.encodeURL(originalURL);

Now, encodedURL will be encoded with the session id if the jsessionid cookie was not found. For session tracking to work, this technique must be used consistently for every hyperlink and form action on a web site.

8.2.2. Session Tracking with Java and XSLT

<xsl:template match="cart">
  Click on the link to move next:
  <a href="/shopping/moveNext"/>Move Next</a>
  ...
</xsl:template>

Like before, the jsessionid needs to be concatenated to the URL. To make this happen, the following steps must be performed:

1. In the servlet, determine if cookies are enabled or disabled.

2. If cookies are disabled, get the value of jsessionid.

3. Pass ;jsessionid=XXXX as a parameter to the XSLT stylesheet, where XXXX is the session identifier.

4. In the stylesheet, append the session id parameter to all URLs in hyperlinks and form actions.

The critical lines of code are emphasized. The first of these checks to see if the session was not obtained using a cookie:

if (!req.isRequestedSessionIdFromCookie( )) {

For the very first request, the cookie will not be present because the servlet has not had a chance to create it. For all subsequent requests, the cookie will be missing if the user has disabled cookies in the browser. Under either scenario, the session identifier is obtained from the HttpSession instance:

String sessionID = session.getId( );

The servlet API takes care of generating a random session identifier; you are responsible for preserving this identifier by passing it as a parameter to the stylesheet. This is done as follows:

trans.setParameter("global.sessionID", 
       ";jsessionid=" + sessionID);

This servlet also takes the liberty of prefixing the session identifier with ";jessionid=". This makes the XSLT stylesheet simpler, because it does not have to check if the session ID is an empty string or not. As implemented here, the value of global.sessionID can be appended to all URLs:

<a href="/whatever{$global.sessionID}">click here</a>

This stylesheet fully illustrates the three key components that make session tracking with XSLT possible. First, the session identifier is passed to the stylesheet as a parameter:

<xsl:param name="global.sessionID"/>

Next, this session identifier is used for the form action:

<form method="post" action="/chap8/shopping{$global.sessionID}">

And finally, it is used for all hyperlinks:

<a href="/shopping/moveNext{$global.sessionID}?param=value"/>Move Next</a>

The ?param=value string was added here to illustrate that request parameters are appended after the session identifier. Therefore, the full URL will look similar to the following when the user clicks on the hyperlink:

http://localhost:8080/shopping/moveNext;jsessionid=298ulkj2348734jkj43?param=value