HttpSession (Servlet 6.1 API Documentation - Apache Tomcat 11.0.24)
Description: declaration: package: jakarta.servlet.http, interface: HttpSession

# Interface HttpSession

public interface HttpSession
Provides a way to identify a user across more than one page request or visit to a website and to store information about that user.

The servlet container uses this interface to create a session between an HTTP client and an HTTP server. The session persists for a specified time period, across more than one connection or page request from the user. A session usually corresponds to one user, who may visit a site many times. The server can maintain a session in many ways such as using cookies or rewriting URLs.

This interface allows servlets to

- View and manipulate information about a session, such as the session identifier, creation time, and last accessed time
- Bind objects to sessions, allowing user information to persist across multiple user connections

When an application stores an object in or removes an object from a session, the session checks whether the object implements `HttpSessionBindingListener`. If it does, the servlet notifies the object that it has been bound to or unbound from the session. Notifications are sent after the binding methods complete. For session that are invalidated or expire, notifications are sent after the session has been invalidated or expired.

When container migrates a session between VMs in a distributed container setting, all session attributes implementing the `HttpSessionActivationListener` interface are notified.

A servlet should be able to handle cases in which the client does not choose to join a session, such as when cookies are intentionally turned off. Until the client joins the session, `isNew` returns `true`. If the client chooses not to join the session, `getSession` will return a different session on each request, and `isNew` will always return `true`.

Session information is scoped only to the current web application ( `ServletContext`), so information stored in one context will not be directly visible in another.

This object is only valid within the scope of the HTTP request from which it was obtained. Once the processing of that request returns to the container, this object must not be used. If there is a requirement to access the session outside the scope of an HTTP request then this must be done via `#getAccessor()`.

See Also:
  - `HttpSessionBindingListener`

- ## Nested Class Summary

  Nested Classes
  Modifier and Type
  Interface
  Description
  `static interface`
  `HttpSession.Accessor`
  Provides a mechanism for applications to interact with the `HttpSession` outside of the scope of an HTTP request.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `default HttpSession.Accessor`
  `getAccessor()`
  Provides a mechanism for applications to interact with the `HttpSession` outside of the scope of an HTTP request.
  `Object`
  `getAttribute(String name)`
  Returns the object bound with the specified name in this session, or `null` if no object is bound under the name.
  `Enumeration<String>`
  `getAttributeNames()`
  Returns an `Enumeration` of `String` objects containing the names of all the objects bound to this session.
  `long`
  `getCreationTime()`
  Returns the time when this session was created, measured in milliseconds since midnight January 1, 1970 GMT.
  `String`
  `getId()`
  Returns a string containing the unique identifier assigned to this session.
  `long`
  `getLastAccessedTime()`
  Returns the last time the client sent a request associated with this session, as the number of milliseconds since midnight January 1, 1970 GMT, and marked by the time the container received the request.
  `int`
  `getMaxInactiveInterval()`
  Returns the maximum time interval, in seconds, that the servlet container will keep this session open between client accesses.
  `ServletContext`
  `getServletContext()`
  Returns the ServletContext to which this session belongs.
  `void`
  `invalidate()`
  Invalidates this session then unbinds any objects bound to it.
  `boolean`
  `isNew()`
  Returns `true` if the client does not yet know about the session or if the client chooses not to join the session.
  `void`
  `removeAttribute(String name)`
  Removes the object bound with the specified name from this session.
  `void`
  `setAttribute(String name, Object value)`
  Binds an object to this session, using the name specified.
  `void`
  `setMaxInactiveInterval(int interval)`
  Specifies the time, in seconds, between client requests before the servlet container will invalidate this session.

- ## Method Details

  - ### getCreationTime

    long getCreationTime()
    Returns the time when this session was created, measured in milliseconds since midnight January 1, 1970 GMT.
    Returns:
      a `long` specifying when this session was created, expressed in milliseconds since 1/1/1970 GMT
    Throws:
      `IllegalStateException` - if this method is called on an invalidated session

  - ### getId

    String getId()
    Returns a string containing the unique identifier assigned to this session. The identifier is assigned by the servlet container and is implementation dependent.
    Returns:
      a string specifying the identifier assigned to this session
    Throws:
      `IllegalStateException` - if this method is called on an invalidated session

  - ### getLastAccessedTime

    long getLastAccessedTime()
    Returns the last time the client sent a request associated with this session, as the number of milliseconds since midnight January 1, 1970 GMT, and marked by the time the container received the request.

    Actions that your application takes, such as getting or setting a value associated with the session, do not affect the access time.

    Returns:
      a `long` representing the last time the client sent a request associated with this session, expressed in milliseconds since 1/1/1970 GMT
    Throws:
      `IllegalStateException` - if this method is called on an invalidated session

  - ### getServletContext

    ServletContext getServletContext()
    Returns the ServletContext to which this session belongs.
    Returns:
      The ServletContext object for the web application
    Since:
      Servlet 2.3

  - ### setMaxInactiveInterval

    void setMaxInactiveInterval(int interval)
    Specifies the time, in seconds, between client requests before the servlet container will invalidate this session. A zero or negative time indicates that the session should never time out.
    Parameters:
      `interval` - An integer specifying the number of seconds

  - ### getMaxInactiveInterval

    int getMaxInactiveInterval()
    Returns the maximum time interval, in seconds, that the servlet container will keep this session open between client accesses. After this interval, the servlet container will invalidate the session. The maximum time interval can be set with the `setMaxInactiveInterval` method. A zero or negative time indicates that the session should never time out.
    Returns:
      an integer specifying the number of seconds this session remains open between client requests
    See Also:
      - `setMaxInactiveInterval(int)`

  - ### getAttribute

    Object getAttribute(String name)
    Returns the object bound with the specified name in this session, or `null` if no object is bound under the name.
    Parameters:
      `name` - a string specifying the name of the object
    Returns:
      the object with the specified name
    Throws:
      `IllegalStateException` - if this method is called on an invalidated session

  - ### getAttributeNames

    Enumeration<String> getAttributeNames()
    Returns an `Enumeration` of `String` objects containing the names of all the objects bound to this session.
    Returns:
      an `Enumeration` of `String` objects specifying the names of all the objects bound to this session
    Throws:
      `IllegalStateException` - if this method is called on an invalidated session

  - ### setAttribute

    void setAttribute(String name, Object value)
    Binds an object to this session, using the name specified. If an object of the same name is already bound to the session, the object is replaced.

    After this method executes, and if the new object implements `HttpSessionBindingListener`, the container calls `HttpSessionBindingListener.valueBound`. The container then notifies any `HttpSessionAttributeListener`s in the web application.

    If an object was already bound to this session of this name that implements `HttpSessionBindingListener`, its `HttpSessionBindingListener.valueUnbound` method is called.

    If the value passed in is null, this has the same effect as calling `removeAttribute()`.

    Parameters:
      `name` - the name to which the object is bound; cannot be null
      `value` - the object to be bound
    Throws:
      `IllegalStateException` - if this method is called on an invalidated session

  - ### removeAttribute

    void removeAttribute(String name)
    Removes the object bound with the specified name from this session. If the session does not have an object bound with the specified name, this method does nothing.

    After this method executes, and if the object implements `HttpSessionBindingListener`, the container calls `HttpSessionBindingListener.valueUnbound`. The container then notifies any `HttpSessionAttributeListener`s in the web application.

    Parameters:
      `name` - the name of the object to remove from this session
    Throws:
      `IllegalStateException` - if this method is called on an invalidated session

  - ### invalidate

    void invalidate()
    Invalidates this session then unbinds any objects bound to it.
    Throws:
      `IllegalStateException` - if this method is called on an already invalidated session

  - ### isNew

    boolean isNew()
    Returns `true` if the client does not yet know about the session or if the client chooses not to join the session. For example, if the server used only cookie-based sessions, and the client had disabled the use of cookies, then a session would be new on each request.
    Returns:
      `true` if the server has created a session, but the client has not yet joined
    Throws:
      `IllegalStateException` - if this method is called on an already invalidated session

  - ### getAccessor

    default HttpSession.Accessor getAccessor()
    Provides a mechanism for applications to interact with the `HttpSession` outside of the scope of an HTTP request.
    Returns:
      An `HttpSession.Accessor` instance linked to the current session ID (if the session ID is changed the `HttpSession.Accessor` will no longer be able to access this session)
    Throws:
      `IllegalStateException` - if this method is called on an invalid session