Why is my servlet session not persistent?

Question

My servlet is working as expected other than when I close the browser (I am not deleting cookies), the session is lost. How can I save the session indefinitely until I invalidate it or I delete my cookies?

@WebServlet(name="ServletOne", urlPatterns={"/", "/ServletOne"})
public class ServletOne extends HttpServlet {
    private static final long serialVersionUID = 1L;

    public void doGet(HttpServletRequest request, HttpServletResponse response)
                throws ServletException, IOException {
        HttpSession session = request.getSession(true);
        String newValue = request.getParameter("newValue");

        if (session.isNew()) {
            session = request.getSession(true);
            session.setAttribute("myAttribute", "value");
        }

        if (newValue != null)
            session.setAttribute("myAttribute", newValue);

        RequestDispatcher rd = request.getRequestDispatcher("test.jsp");
        rd.forward(request, response);
    }

    public void doPost(HttpServletRequest request, HttpServletResponse response)
                throws ServletException, IOException {
        doGet(request, response);
    }
}

My JSP:

<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
    val == <c:out value="${myAttribute}"></c:out><br>
    <form action="ServletOne" method="POST">
        <input type="text" name="newValue" />
        <input type="submit" />
    </form>
</body>
</html>

If I close the browser and reopen it, myAttribute is always set to the default "value".

Looks like you have no idea what a session is. -1 – Bastian Voigt Dec 08 '16 at 15:37 — Bastian Voigt, Dec 08 '16 at 15:37

score 6 · Accepted Answer · edited Jun 20 '20 at 09:12

It look like that you completely misunderstood how session cookies work.

Session cookies live as long as the browser instance lives and you're firing HTTP requests on the target URL which is covered by cookie's path within time before the default server side session expiration time — which defaults to 30 minutes.

Once you close the browser instance (read: the browser session), all session cookies are gone. This is fully specified, expected and natural behavior. Web browsers have always worked that way for decades. Please note that the HttpSession instance associated with the cookie is still present in the server. If you implement a HttpSessionListener based on this related answer SessionTimeout: web.xml vs session.maxInactiveInterval(), then you'll notice that sessionDestroyed() method isn't immediately invoked when the browser is closed, but only after a little more than 30 minutes.

If you reopen the browser instance and perform a session hijacking attack within time before its server-side expiration, then you'll be able to retain the associated HttpSession instance.

Now, coming back to your concrete functional requirement of keeping the cookie alive for longer than a browser session, this is actually quite simple: create your own cookie which is not a session cookie. I.e. do not set the cookie's maxAge to -1 (default value), but instead set it to a specified time in seconds.

Cookie cookie = new Cookie("someCommonName", "someUniqueValue");
cookie.setMaxAge(ageInSeconds); // Use e.g. 2952000 for 30 days.
response.addCookie(cookie);

The someUniqueValue can in turn be something like java.util.UUID. You can use that value as a key of some data storage system (a SQL DB?) wherein you also save that myattribute value. On every subsequent request, just check the presence of the cookie via request.getCookies(). This way you can associate it with the client. If necessary, cache it in the HTTP session so that you don't need to check every single HTTP request.

Why is my servlet session not persistent?

1 Answers1

See also:

See also: