Following up on this old Javalin - Jetty Session Tracking post. At the end of that post, I mentioned “one final catch”, wherein I needed to explicitly run
ctx.req.getSession() in order to start logging session data to my relational
jettysessions table. That was due to my lack of understanding about some of the configuration options which are provided by Jetty.
For Jetty 9, you can find an overview here: Session Management.
And the equivalent in Jetty 10: HTTP Session Management.
Some key Jetty 9 classes are:
Some key settings include the following:
|Integer. Sets the session timeout interval in seconds (i.e. the period of inactivity).
|Boolean. True if session cookies should only use HTTP. (see HTTP cookies.)
|Boolean. Whether or not a session that is newly created should be immediately saved. If false, a session that is created and invalidated within a single request is never persisted.
|Boolean. If true, a dirty (i.e. changed) session will be written to the SessionDataStore just before a response is returned to the client.
|Boolean. If true, all existing sessions in the cache will be invalidated when the server shuts down. Default is false.
|Integer. Period in seconds between runs of the session scavenger (10 minutes by default).
So, for example, a session handler method might look like this:
Also remember that classes which are going to be stored in sessions need to implement
Serializable. For example, a javabean representing a user (avoiding any sensitive data, for security).