会话跟踪技术：Cookie与Session

最新推荐文章于 2025-12-01 18:34:47 发布

原创最新推荐文章于 2025-12-01 18:34:47 发布 · 77 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#java #web

文章详细介绍了Web应用中如何使用Cookie和Session进行会话跟踪。Cookie用于在客户端存储小量信息，设置MaxAge可控制其生命周期；Session则在服务器端存储数据，依赖于Cookie的JSESSIONID来标识。同时，文中展示了创建、读取Cookie和Session的JavaServlet代码示例，并讨论了它们在购物车、记住我功能以及登录验证等场景的应用。

浏览器访问服务器直至一方断开为一次会话，包括多个请求响应。

会话跟踪：判断多次请求是否同一浏览器，以便共享数据。

cookie数据存放浏览器(响应头Set-Cookie:key=value,)，每次请求携带cookie访问服务器。

session共享数据存服务器。

cookie最大3k，session无限制。cookie放浏览器不安全，session放服务器安全。

Cookie

服务器向浏览器存cookie

pom引入Servlet、JSP、JSTL、Standard坐标和Tomcat7的插件plugin

@WebServlet("/aServlet")
public class AServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        Cookie nameCookie = new Cookie("name","zhangsan");
        String englishTeacher = "王五";//cookie存中文需要转码为URL格式编码
        englishTeacher = URLEncoder.encode(englishTeacher,"UTF-8");
        Cookie englishTeacherCookie = new Cookie("englishTeacher", englishTeacher);
        //nameCookie.setMaxAge(60*60*24*7);//设置cookie最大存放时间
        resp.addCookie(nameCookie);
        resp.addCookie(englishTeacherCookie);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req,resp);
    }
}

访问结果：响应头Set-Cookie:name=zhangsan Set-Cookie:englishTeacher=%E9%90

浏览器携带cookie请求服务器

@WebServlet("/bServlet")
public class BServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        Cookie[] cookies = req.getCookies();
        for (Cookie cookie:cookies) {
            String name = cookie.getName();
            if ("name".equals(name)){
                String value = cookie.getValue();
                System.out.println(name+":"+value);
            }
            if("englishTeacher".equals(cookie.getName())){
                String value = cookie.getValue();
                value = URLDecoder.decode(value,"UTF-8");
                System.out.println(name+":"+value);
            }
        }
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req,resp);
    }
}

访问结果：请求头里Cookie:name=zhangsan; englishTeacher=%E9%90%9C%E5%AC;

浏览器先访问http://localhost:8080/CookieAndSession/aServlet

再访问http://localhost:8080/CookieAndSession/bServlet

Session

session是基于cookie，第一次session.setAttribute会向浏览器响应头设置set-cookie:JESSIONID=xx的属性。之后浏览器会携带请求头cookie:JESSIONID=xx

服务器正常关闭session会钝化写入硬盘，再次启动服务器session会活化。

默认服务器session30分钟销毁(见tomcat的conf/web.xml)。我们可调用session.invalidate()直接销毁session，也可在webapp的WEB-INFO的web.xml中进行配置session存放时间：

    <session-config>
        <session-timeout>100</session-timeout>
    </session-config>

@WebServlet("/aSessionServlet")
public class ASessionServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        HttpSession session = req.getSession();
        session.setAttribute("name","zhangsan");
        session.setAttribute("password","zhangsan123");
        session.setAttribute("englishTeacher","王五");
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req,resp);
    }
}

@WebServlet("/bSessionServlet")
public class BSessionServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        HttpSession session = req.getSession();
        Object name = session.getAttribute("name");
        session.removeAttribute("password");
        Object password = session.getAttribute("password");
        Object englishTeacher = session.getAttribute("englishTeacher");
        System.out.println(name);
        System.out.println(password);
        System.out.println(englishTeacher);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req,resp);
    }
}