#session
Posts
-
Digging into Tomcat's Source 11: Sessions — How JSESSIONID Is Made and Removed
We follow, in the source, what Tomcat does behind one call to request.getSession() — where it reads the session ID, how it makes a new one, and when it throws it away. Cookies and ;jsessionid, the 32-character ID built from SecureRandom, the two kinds of expiry (on a request and on a background thread), and StandardManager saving sessions to a file across restarts, each checked with a small example.