SessionHandler (Jetty :: Server Core 9.4.2.v20180619 API)

java.lang.Object
- org.eclipse.jetty.util.component.AbstractLifeCycle
- - org.eclipse.jetty.util.component.ContainerLifeCycle
  - - org.eclipse.jetty.server.handler.AbstractHandler
    - - org.eclipse.jetty.server.handler.AbstractHandlerContainer
      - org.eclipse.jetty.server.handler.HandlerWrapper
        
        org.eclipse.jetty.server.handler.ScopedHandler
        
        org.eclipse.jetty.server.session.SessionHandler

All Implemented Interfaces:

Handler, HandlerContainer, org.eclipse.jetty.util.component.Destroyable, org.eclipse.jetty.util.component.LifeCycle
```
public class SessionHandler
extends ScopedHandler
```
SessionHandler.

Nested Class Summary

Nested Classes
Modifier and Type	Class	Description
`class`	`SessionHandler.CookieConfig`	CookieConfig Implementation of the javax.servlet.SessionCookieConfig.
`class`	`SessionHandler.SessionAsyncListener`	SessionAsyncListener Used to ensure that a request for which async has been started has its session completed as the request exits the context.
`static interface`	`SessionHandler.SessionIf`	SessionIf Interface that any session wrapper should implement so that SessionManager may access the Jetty session implementation.

Nested classes/interfaces inherited from class org.eclipse.jetty.server.handler.AbstractHandler
AbstractHandler.ErrorDispatchHandler

Nested classes/interfaces inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle
org.eclipse.jetty.util.component.AbstractLifeCycle.AbstractLifeCycleListener

Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.Container
org.eclipse.jetty.util.component.Container.InheritedListener, org.eclipse.jetty.util.component.Container.Listener

Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.LifeCycle
org.eclipse.jetty.util.component.LifeCycle.Listener

Field Summary

Fields
Modifier and Type	Field	Description
`static java.lang.String`	`__CheckRemoteSessionEncoding`
`static java.lang.String`	`__DefaultSessionCookie`
`static java.lang.String`	`__DefaultSessionDomain`
`static java.lang.String`	`__DefaultSessionIdPathParameterName`
`java.util.Set<javax.servlet.SessionTrackingMode>`	`__defaultSessionTrackingModes`
`static java.lang.String`	`__MaxAgeProperty`	Session Max Age.
`static java.lang.String`	`__SessionCookieProperty`	Session cookie name.
`static java.lang.String`	`__SessionDomainProperty`	Session Domain.
`static java.lang.String`	`__SessionIdPathParameterNameProperty`	Session id path parameter name.
`static java.lang.String`	`__SessionPathProperty`	Session Path.
`protected org.eclipse.jetty.util.ConcurrentHashSet<java.lang.String>`	`_candidateSessionIdsForExpiry`
`protected boolean`	`_checkingRemoteSessionIdEncoding`
`protected ContextHandler.Context`	`_context`
`protected int`	`_dftMaxIdleSecs`	Setting of max inactive interval for new sessions -1 means no timeout
`protected boolean`	`_httpOnly`
`protected java.lang.ClassLoader`	`_loader`
`protected int`	`_maxCookieAge`
`protected boolean`	`_nodeIdInSessionId`
`protected boolean`	`_ownScheduler`
`protected int`	`_refreshCookieAge`
`protected org.eclipse.jetty.util.thread.Scheduler`	`_scheduler`
`protected boolean`	`_secureCookies`
`protected boolean`	`_secureRequestOnly`
`protected java.util.List<javax.servlet.http.HttpSessionAttributeListener>`	`_sessionAttributeListeners`
`protected SessionCache`	`_sessionCache`
`protected java.lang.String`	`_sessionComment`
`protected SessionContext`	`_sessionContext`
`protected java.lang.String`	`_sessionCookie`
`protected java.lang.String`	`_sessionDomain`
`protected java.util.List<javax.servlet.http.HttpSessionIdListener>`	`_sessionIdListeners`
`protected SessionIdManager`	`_sessionIdManager`
`protected java.lang.String`	`_sessionIdPathParameterName`
`protected java.lang.String`	`_sessionIdPathParameterNamePrefix`
`protected java.util.List<javax.servlet.http.HttpSessionListener>`	`_sessionListeners`
`protected java.lang.String`	`_sessionPath`
`protected org.eclipse.jetty.util.statistic.CounterStatistic`	`_sessionsCreatedStats`
`protected org.eclipse.jetty.util.statistic.SampleStatistic`	`_sessionTimeStats`
`java.util.Set<javax.servlet.SessionTrackingMode>`	`_sessionTrackingModes`
`protected boolean`	`_usingCookies`
`protected boolean`	`_usingURLs`
`static java.util.EnumSet<javax.servlet.SessionTrackingMode>`	`DEFAULT_TRACKING`
`static java.math.BigDecimal`	`MAX_INACTIVE_MINUTES`	Web.xml session-timeout is set in minutes, but is stored as an int in seconds by HttpSession and the sessionmanager.
`static java.lang.Class<? extends java.util.EventListener>[]`	`SESSION_LISTENER_TYPES`

Fields inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle
FAILED, RUNNING, STARTED, STARTING, STOPPED, STOPPING

Fields inherited from class org.eclipse.jetty.server.handler.HandlerWrapper
_handler

Fields inherited from class org.eclipse.jetty.server.handler.ScopedHandler
_nextScope, _outerScope

Constructor Summary

Constructors
Constructor Description

SessionHandler()
Constructor.

Constructors
Constructor	Description
`SessionHandler()`	Constructor.

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`org.eclipse.jetty.http.HttpCookie`	`access(javax.servlet.http.HttpSession session, boolean secure)`	Called by the `SessionHandler` when a session is first accessed by a request.
`void`	`addEventListener(java.util.EventListener listener)`	Adds an event listener for session-related events.
`protected void`	`checkRequestedSessionId(Request baseRequest, javax.servlet.http.HttpServletRequest request)`	Look for a requested session ID in cookies and URI parameters
`void`	`clearEventListeners()`	Removes all event listeners for session-related events.
`void`	`complete(javax.servlet.http.HttpSession session)`	Called by the `SessionHandler` when a session is last accessed by a request.
`void`	`complete(Session session, Request request)`
`void`	`doHandle(java.lang.String target, Request baseRequest, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)`	Do the handler work within the scope.
`void`	`doScope(java.lang.String target, Request baseRequest, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)`	Scope the handler
`void`	`doSessionAttributeListeners(Session session, java.lang.String name, java.lang.Object old, java.lang.Object value)`
`protected void`	`doStart()`
`protected void`	`doStop()`
`java.util.Set<javax.servlet.SessionTrackingMode>`	`getDefaultSessionTrackingModes()`
`java.util.Set<javax.servlet.SessionTrackingMode>`	`getEffectiveSessionTrackingModes()`
`java.lang.String`	`getExtendedId(javax.servlet.http.HttpSession session)`
`boolean`	`getHttpOnly()`
`javax.servlet.http.HttpSession`	`getHttpSession(java.lang.String extendedId)`	Returns the `HttpSession` with the given session id
`java.lang.String`	`getId(javax.servlet.http.HttpSession session)`
`int`	`getMaxCookieAge()`
`int`	`getMaxInactiveInterval()`
`int`	`getRefreshCookieAge()`
`org.eclipse.jetty.util.thread.Scheduler`	`getScheduler()`
`boolean`	`getSecureCookies()`
`Session`	`getSession(java.lang.String id)`	Get a known existing session
`SessionCache`	`getSessionCache()`
`java.lang.String`	`getSessionCookie()`
`org.eclipse.jetty.http.HttpCookie`	`getSessionCookie(javax.servlet.http.HttpSession session, java.lang.String contextPath, boolean requestIsSecure)`	A session cookie is marked as secure IFF any of the following conditions are true: SessionCookieConfig.setSecure == true SessionCookieConfig.setSecure == false && _secureRequestOnly==true && request is HTTPS According to SessionCookieConfig javadoc, case 1 can be used when: "...
`javax.servlet.SessionCookieConfig`	`getSessionCookieConfig()`
`java.lang.String`	`getSessionDomain()`
`SessionIdManager`	`getSessionIdManager()`	Gets the cross context session id manager
`java.lang.String`	`getSessionIdPathParameterName()`
`java.lang.String`	`getSessionIdPathParameterNamePrefix()`
`java.lang.String`	`getSessionPath()`
`int`	`getSessionsCreated()`
`long`	`getSessionTimeMax()`
`double`	`getSessionTimeMean()`
`double`	`getSessionTimeStdDev()`
`long`	`getSessionTimeTotal()`
`void`	`invalidate(java.lang.String id)`	Called when a session has expired.
`boolean`	`isCheckingRemoteSessionIdEncoding()`
`boolean`	`isIdInUse(java.lang.String id)`	Check if id is in use by this context
`boolean`	`isNodeIdInSessionId()`
`boolean`	`isSecureRequestOnly()`
`boolean`	`isUsingCookies()`
`boolean`	`isUsingURLs()`
`boolean`	`isValid(javax.servlet.http.HttpSession session)`
`javax.servlet.http.HttpSession`	`newHttpSession(javax.servlet.http.HttpServletRequest request)`	Creates a new `HttpSession`.
`void`	`removeEventListener(java.util.EventListener listener)`	Removes an event listener for for session-related events.
`Session`	`removeSession(java.lang.String id, boolean invalidate)`	Remove session from manager
`void`	`renewSessionId(java.lang.String oldId, java.lang.String oldExtendedId, java.lang.String newId, java.lang.String newExtendedId)`	Change the existing session id.
`void`	`scavenge()`	Called periodically by the HouseKeeper to handle the list of sessions that have expired since the last call to scavenge.
`void`	`sessionInactivityTimerExpired(Session session)`	Each session has a timer that is configured to go off when either the session has not been accessed for a configurable amount of time, or the session itself has passed its expiry.
`void`	`setCheckingRemoteSessionIdEncoding(boolean remote)`
`void`	`setHttpOnly(boolean httpOnly)`
`void`	`setMaxInactiveInterval(int seconds)`	Sets the max period of inactivity, after which the session is invalidated, in seconds.
`void`	`setNodeIdInSessionId(boolean nodeIdInSessionId)`
`void`	`setRefreshCookieAge(int ageInSeconds)`
`void`	`setSecureRequestOnly(boolean secureRequestOnly)`	HTTPS request.
`void`	`setSessionCache(SessionCache cache)`
`void`	`setSessionCookie(java.lang.String cookieName)`
`void`	`setSessionIdManager(SessionIdManager metaManager)`
`void`	`setSessionIdPathParameterName(java.lang.String param)`	Sets the session id URL path parameter name.
`void`	`setSessionTrackingModes(java.util.Set<javax.servlet.SessionTrackingMode> sessionTrackingModes)`
`void`	`setUsingCookies(boolean usingCookies)`
`protected void`	`shutdownSessions()`	Prepare sessions for session manager shutdown
`void`	`statsReset()`	Reset statistics values
`java.lang.String`	`toString()`

Methods inherited from class org.eclipse.jetty.server.handler.AbstractHandler
doError, dumpThis, getServer

Methods inherited from class org.eclipse.jetty.server.handler.AbstractHandlerContainer
expandHandler, findContainerOf, getChildHandlerByClass, getChildHandlers, getChildHandlersByClass, setServer

Methods inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle
addLifeCycleListener, getState, getState, getStopTimeout, isFailed, isRunning, isStarted, isStarting, isStopped, isStopping, removeLifeCycleListener, start, stop

Methods inherited from class org.eclipse.jetty.util.component.ContainerLifeCycle
addBean, addBean, addBean, addEventListener, addManaged, contains, dump, dump, dump, dump, dump, dumpBeans, dumpObject, dumpStdErr, getBean, getBeans, getBeans, isManaged, manage, removeBean, removeBeans, removeEventListener, setBeans, setStopTimeout, start, stop, unmanage, updateBean, updateBean, updateBeans

Methods inherited from class org.eclipse.jetty.server.handler.HandlerWrapper
destroy, expandChildren, getHandler, getHandlers, insertHandler, setHandler

Methods inherited from interface org.eclipse.jetty.util.component.LifeCycle
addLifeCycleListener, isFailed, isRunning, isStarted, isStarting, isStopped, isStopping, removeLifeCycleListener, start, stop

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from class org.eclipse.jetty.server.handler.ScopedHandler
handle, nextHandle, nextScope

- Field Detail
  - DEFAULT_TRACKING
```
public static final java.util.EnumSet<javax.servlet.SessionTrackingMode> DEFAULT_TRACKING
```
  - __SessionCookieProperty
```
public static final java.lang.String __SessionCookieProperty
```
    Session cookie name. Defaults to JSESSIONID, but can be set with the org.eclipse.jetty.servlet.SessionCookie context init parameter.
    
    See Also:
    
    Constant Field Values
  - __DefaultSessionCookie
```
public static final java.lang.String __DefaultSessionCookie
```
    See Also:
    
    Constant Field Values
  - __SessionIdPathParameterNameProperty
```
public static final java.lang.String __SessionIdPathParameterNameProperty
```
    Session id path parameter name. Defaults to jsessionid, but can be set with the org.eclipse.jetty.servlet.SessionIdPathParameterName context init parameter. If set to null or "none" no URL rewriting will be done.
    
    See Also:
    
    Constant Field Values
  - __DefaultSessionIdPathParameterName
```
public static final java.lang.String __DefaultSessionIdPathParameterName
```
    See Also:
    
    Constant Field Values
  - __CheckRemoteSessionEncoding
```
public static final java.lang.String __CheckRemoteSessionEncoding
```
    See Also:
    
    Constant Field Values
  - __SessionDomainProperty
```
public static final java.lang.String __SessionDomainProperty
```
    Session Domain. If this property is set as a ServletContext InitParam, then it is used as the domain for session cookies. If it is not set, then no domain is specified for the session cookie.
    
    See Also:
    
    Constant Field Values
  - __DefaultSessionDomain
```
public static final java.lang.String __DefaultSessionDomain
```
  - __SessionPathProperty
```
public static final java.lang.String __SessionPathProperty
```
    Session Path. If this property is set as a ServletContext InitParam, then it is used as the path for the session cookie. If it is not set, then the context path is used as the path for the cookie.
    
    See Also:
    
    Constant Field Values
  - __MaxAgeProperty
```
public static final java.lang.String __MaxAgeProperty
```
    Session Max Age. If this property is set as a ServletContext InitParam, then it is used as the max age for the session cookie. If it is not set, then a max age of -1 is used.
    
    See Also:
    
    Constant Field Values
  - __defaultSessionTrackingModes
```
public java.util.Set<javax.servlet.SessionTrackingMode> __defaultSessionTrackingModes
```
  - SESSION_LISTENER_TYPES
```
public static final java.lang.Class<? extends java.util.EventListener>[] SESSION_LISTENER_TYPES
```
  - MAX_INACTIVE_MINUTES
```
public static final java.math.BigDecimal MAX_INACTIVE_MINUTES
```
    Web.xml session-timeout is set in minutes, but is stored as an int in seconds by HttpSession and the sessionmanager. Thus MAX_INT is the max number of seconds that can be set, and MAX_INT/60 is the max number of minutes that you can set.
  - _dftMaxIdleSecs
```
protected int _dftMaxIdleSecs
```
    Setting of max inactive interval for new sessions -1 means no timeout
  - _httpOnly
```
protected boolean _httpOnly
```
  - _sessionIdManager
```
protected SessionIdManager _sessionIdManager
```
  - _secureCookies
```
protected boolean _secureCookies
```
  - _secureRequestOnly
```
protected boolean _secureRequestOnly
```
  - _sessionAttributeListeners
```
protected final java.util.List<javax.servlet.http.HttpSessionAttributeListener> _sessionAttributeListeners
```
  - _sessionListeners
```
protected final java.util.List<javax.servlet.http.HttpSessionListener> _sessionListeners
```
  - _sessionIdListeners
```
protected final java.util.List<javax.servlet.http.HttpSessionIdListener> _sessionIdListeners
```
  - _loader
```
protected java.lang.ClassLoader _loader
```
  - _context
```
protected ContextHandler.Context _context
```
  - _sessionContext
```
protected SessionContext _sessionContext
```
  - _sessionCookie
```
protected java.lang.String _sessionCookie
```
  - _sessionIdPathParameterName
```
protected java.lang.String _sessionIdPathParameterName
```
  - _sessionIdPathParameterNamePrefix
```
protected java.lang.String _sessionIdPathParameterNamePrefix
```
  - _sessionDomain
```
protected java.lang.String _sessionDomain
```
  - _sessionPath
```
protected java.lang.String _sessionPath
```
  - _maxCookieAge
```
protected int _maxCookieAge
```
  - _refreshCookieAge
```
protected int _refreshCookieAge
```
  - _nodeIdInSessionId
```
protected boolean _nodeIdInSessionId
```
  - _checkingRemoteSessionIdEncoding
```
protected boolean _checkingRemoteSessionIdEncoding
```
  - _sessionComment
```
protected java.lang.String _sessionComment
```
  - _sessionCache
```
protected SessionCache _sessionCache
```
  - _sessionTimeStats
```
protected final org.eclipse.jetty.util.statistic.SampleStatistic _sessionTimeStats
```
  - _sessionsCreatedStats
```
protected final org.eclipse.jetty.util.statistic.CounterStatistic _sessionsCreatedStats
```
  - _sessionTrackingModes
```
public java.util.Set<javax.servlet.SessionTrackingMode> _sessionTrackingModes
```
  - _usingURLs
```
protected boolean _usingURLs
```
  - _usingCookies
```
protected boolean _usingCookies
```
  - _candidateSessionIdsForExpiry
```
protected org.eclipse.jetty.util.ConcurrentHashSet<java.lang.String> _candidateSessionIdsForExpiry
```
  - _scheduler
```
protected org.eclipse.jetty.util.thread.Scheduler _scheduler
```
  - _ownScheduler
```
protected boolean _ownScheduler
```
- Constructor Detail
  - SessionHandler
```
public SessionHandler()
```
    Constructor.
- Method Detail
  - getSessionPath
```
@ManagedAttribute("path of the session cookie, or null for default")
public java.lang.String getSessionPath()
```
  - getMaxCookieAge
```
@ManagedAttribute("if greater the zero, the time in seconds a session cookie will last for")
public int getMaxCookieAge()
```
  - access
```
public org.eclipse.jetty.http.HttpCookie access(javax.servlet.http.HttpSession session,
                                                boolean secure)
```
    Called by the SessionHandler when a session is first accessed by a request.
    
    Parameters:
    
    session - the session object
    
    secure - whether the request is secure or not
    
    Returns:
    
    the session cookie. If not null, this cookie should be set on the response to either migrate the session or to refresh a session cookie that may expire.
    
    See Also:
    
    complete(HttpSession)
  - addEventListener
```
public void addEventListener(java.util.EventListener listener)
```
    Adds an event listener for session-related events.
    
    Parameters:
    
    listener - the session event listener to add Individual SessionManagers implementations may accept arbitrary listener types, but they are expected to at least handle HttpSessionActivationListener, HttpSessionAttributeListener, HttpSessionBindingListener and HttpSessionListener.
    
    See Also:
    
    removeEventListener(EventListener)
  - clearEventListeners
```
public void clearEventListeners()
```
    Removes all event listeners for session-related events.
    
    See Also:
    
    removeEventListener(EventListener)
  - complete
```
public void complete(javax.servlet.http.HttpSession session)
```
    Called by the SessionHandler when a session is last accessed by a request.
    
    Parameters:
    
    session - the session object
    
    See Also:
    
    access(HttpSession, boolean)
  - complete
```
public void complete(Session session,
                     Request request)
```
  - doStart
```
protected void doStart()
                throws java.lang.Exception
```
    Overrides:
    
    doStart in class ScopedHandler
    
    Throws:
    
    java.lang.Exception
    
    See Also:
    
    AbstractHandler.doStart()
  - doStop
```
protected void doStop()
               throws java.lang.Exception
```
    Overrides:
    
    doStop in class AbstractHandler
    
    Throws:
    
    java.lang.Exception
  - getHttpOnly
```
@ManagedAttribute("true if cookies use the http only flag")
public boolean getHttpOnly()
```
    Returns:
    
    true if session cookies should be HTTP-only (Microsoft extension)
    
    See Also:
    
    HttpCookie.isHttpOnly()
  - getHttpSession
```
public javax.servlet.http.HttpSession getHttpSession(java.lang.String extendedId)
```
    Returns the HttpSession with the given session id
    
    Parameters:
    
    extendedId - the session id
    
    Returns:
    
    the HttpSession with the corresponding id or null if no session with the given id exists
  - getSessionIdManager
```
@ManagedAttribute("Session ID Manager")
public SessionIdManager getSessionIdManager()
```
    Gets the cross context session id manager
    
    Returns:
    
    the session id manager
  - getMaxInactiveInterval
```
@ManagedAttribute("default maximum time a session may be idle for (in s)")
public int getMaxInactiveInterval()
```
    Returns:
    
    the max period of inactivity, after which the session is invalidated, in seconds.
    
    See Also:
    
    setMaxInactiveInterval(int)
  - getRefreshCookieAge
```
@ManagedAttribute("time before a session cookie is re-set (in s)")
public int getRefreshCookieAge()
```
  - getSecureCookies
```
@ManagedAttribute("if true, secure cookie flag is set on session cookies")
public boolean getSecureCookies()
```
    Returns:
    
    same as SessionCookieConfig.getSecure(). If true, session cookies are ALWAYS marked as secure. If false, a session cookie is ONLY marked as secure if _secureRequestOnly == true and it is a HTTPS request.
  - isSecureRequestOnly
```
public boolean isSecureRequestOnly()
```
    Returns:
    
    true if session cookie is to be marked as secure only on HTTPS requests
  - setSecureRequestOnly
```
public void setSecureRequestOnly(boolean secureRequestOnly)
```
    HTTPS request. Can be overridden by setting SessionCookieConfig.setSecure(true), in which case the session cookie will be marked as secure on both HTTPS and HTTP.
    
    Parameters:
    
    secureRequestOnly - true to set Session Cookie Config as secure
  - getSessionCookie
```
@ManagedAttribute("the set session cookie")
public java.lang.String getSessionCookie()
```
  - getSessionCookie
```
public org.eclipse.jetty.http.HttpCookie getSessionCookie(javax.servlet.http.HttpSession session,
                                                          java.lang.String contextPath,
                                                          boolean requestIsSecure)
```
    A session cookie is marked as secure IFF any of the following conditions are true:
    1. SessionCookieConfig.setSecure == true
    2. SessionCookieConfig.setSecure == false && _secureRequestOnly==true && request is HTTPS
    According to SessionCookieConfig javadoc, case 1 can be used when: "... even though the request that initiated the session came over HTTP, is to support a topology where the web container is front-ended by an SSL offloading load balancer. In this case, the traffic between the client and the load balancer will be over HTTPS, whereas the traffic between the load balancer and the web container will be over HTTP."
    For case 2, you can use _secureRequestOnly to determine if you want the Servlet Spec 3.0 default behavior when SessionCookieConfig.setSecure==false, which is: "they shall be marked as secure only if the request that initiated the corresponding session was also secure"
    The default for _secureRequestOnly is true, which gives the above behavior. If you set it to false, then a session cookie is NEVER marked as secure, even if the initiating request was secure.
    Parameters:
    
    session - the session to which the cookie should refer.
    
    contextPath - the context to which the cookie should be linked. The client will only send the cookie value when requesting resources under this path.
    
    requestIsSecure - whether the client is accessing the server over a secure protocol (i.e. HTTPS).
    
    Returns:
    
    if this SessionManager uses cookies, then this method will return a new cookie object that should be set on the client in order to link future HTTP requests with the session. If cookies are not in use, this method returns null.
  - getSessionDomain
```
@ManagedAttribute("domain of the session cookie, or null for the default")
public java.lang.String getSessionDomain()
```
  - getSessionsCreated
```
@ManagedAttribute("number of sessions created by this node")
public int getSessionsCreated()
```
  - getSessionIdPathParameterName
```
@ManagedAttribute("name of use for URL session tracking")
public java.lang.String getSessionIdPathParameterName()
```
    Returns:
    
    the URL path parameter name for session id URL rewriting, by default "jsessionid".
    
    See Also:
    
    setSessionIdPathParameterName(String)
  - getSessionIdPathParameterNamePrefix
```
public java.lang.String getSessionIdPathParameterNamePrefix()
```
    Returns:
    
    a formatted version of getSessionIdPathParameterName(), by default ";" + sessionIdParameterName + "=", for easier lookup in URL strings.
    
    See Also:
    
    getSessionIdPathParameterName()
  - isUsingCookies
```
public boolean isUsingCookies()
```
    Returns:
    
    whether the session management is handled via cookies.
  - isValid
```
public boolean isValid(javax.servlet.http.HttpSession session)
```
    Parameters:
    
    session - the session to test for validity
    
    Returns:
    
    whether the given session is valid, that is, it has not been invalidated.
  - getId
```
public java.lang.String getId(javax.servlet.http.HttpSession session)
```
    Parameters:
    
    session - the session object
    
    Returns:
    
    the unique id of the session within the cluster (without a node id extension)
    
    See Also:
    
    getExtendedId(HttpSession)
  - getExtendedId
```
public java.lang.String getExtendedId(javax.servlet.http.HttpSession session)
```
    Parameters:
    
    session - the session object
    
    Returns:
    
    the unique id of the session within the cluster, extended with an optional node id.
    
    See Also:
    
    getId(HttpSession)
  - newHttpSession
```
public javax.servlet.http.HttpSession newHttpSession(javax.servlet.http.HttpServletRequest request)
```
    Creates a new HttpSession.
    
    Parameters:
    
    request - the HttpServletRequest containing the requested session id
    
    Returns:
    
    the new HttpSession
  - removeEventListener
```
public void removeEventListener(java.util.EventListener listener)
```
    Removes an event listener for for session-related events.
    
    Parameters:
    
    listener - the session event listener to remove
    
    See Also:
    
    addEventListener(EventListener)
  - statsReset
```
@ManagedOperation(value="reset statistics",
                  impact="ACTION")
public void statsReset()
```
    Reset statistics values
  - setHttpOnly
```
public void setHttpOnly(boolean httpOnly)
```
    Parameters:
    
    httpOnly - The httpOnly to set.
  - setSessionIdManager
```
public void setSessionIdManager(SessionIdManager metaManager)
```
    Parameters:
    
    metaManager - The metaManager used for cross context session management.
  - setMaxInactiveInterval
```
public void setMaxInactiveInterval(int seconds)
```
    Sets the max period of inactivity, after which the session is invalidated, in seconds.
    
    Parameters:
    
    seconds - the max inactivity period, in seconds.
    
    See Also:
    
    getMaxInactiveInterval()
  - setRefreshCookieAge
```
public void setRefreshCookieAge(int ageInSeconds)
```
  - setSessionCookie
```
public void setSessionCookie(java.lang.String cookieName)
```
  - setSessionIdPathParameterName
```
public void setSessionIdPathParameterName(java.lang.String param)
```
    Sets the session id URL path parameter name.
    
    Parameters:
    
    param - the URL path parameter name for session id URL rewriting (null or "none" for no rewriting).
    
    See Also:
    
    getSessionIdPathParameterName(), getSessionIdPathParameterNamePrefix()
  - setUsingCookies
```
public void setUsingCookies(boolean usingCookies)
```
    Parameters:
    
    usingCookies - The usingCookies to set.
  - getSession
```
public Session getSession(java.lang.String id)
```
    Get a known existing session
    
    Parameters:
    
    id - The session ID stripped of any worker name.
    
    Returns:
    
    A Session or null if none exists.
  - shutdownSessions
```
protected void shutdownSessions()
                         throws java.lang.Exception
```
    Prepare sessions for session manager shutdown
    
    Throws:
    
    java.lang.Exception - if unable to shutdown sesssions
  - getSessionCache
```
public SessionCache getSessionCache()
```
    Returns:
    
    the session store
  - setSessionCache
```
public void setSessionCache(SessionCache cache)
```
    Parameters:
    
    cache -
  - isNodeIdInSessionId
```
public boolean isNodeIdInSessionId()
```
    Returns:
    
    true if the cluster node id (worker id) is returned as part of the session id by HttpSession.getId(). Default is false.
  - setNodeIdInSessionId
```
public void setNodeIdInSessionId(boolean nodeIdInSessionId)
```
    Parameters:
    
    nodeIdInSessionId - true if the cluster node id (worker id) will be returned as part of the session id by HttpSession.getId(). Default is false.
  - removeSession
```
public Session removeSession(java.lang.String id,
                             boolean invalidate)
```
    Remove session from manager
    
    Parameters:
    
    id - The session to remove
    
    invalidate - True if HttpSessionListener.sessionDestroyed(HttpSessionEvent) and SessionIdManager.expireAll(String) should be called.
    
    Returns:
    
    if the session was removed
  - getSessionTimeMax
```
@ManagedAttribute("maximum amount of time sessions have remained active (in s)")
public long getSessionTimeMax()
```
    Returns:
    
    maximum amount of time session remained valid
  - getDefaultSessionTrackingModes
```
public java.util.Set<javax.servlet.SessionTrackingMode> getDefaultSessionTrackingModes()
```
  - getEffectiveSessionTrackingModes
```
public java.util.Set<javax.servlet.SessionTrackingMode> getEffectiveSessionTrackingModes()
```
  - setSessionTrackingModes
```
public void setSessionTrackingModes(java.util.Set<javax.servlet.SessionTrackingMode> sessionTrackingModes)
```
  - isUsingURLs
```
public boolean isUsingURLs()
```
    Returns:
    
    whether the session management is handled via URLs.
  - getSessionCookieConfig
```
public javax.servlet.SessionCookieConfig getSessionCookieConfig()
```
  - getSessionTimeTotal
```
@ManagedAttribute("total time sessions have remained valid")
public long getSessionTimeTotal()
```
    Returns:
    
    total amount of time all sessions remained valid
  - getSessionTimeMean
```
@ManagedAttribute("mean time sessions remain valid (in s)")
public double getSessionTimeMean()
```
    Returns:
    
    mean amount of time session remained valid
  - getSessionTimeStdDev
```
@ManagedAttribute("standard deviation a session remained valid (in s)")
public double getSessionTimeStdDev()
```
    Returns:
    
    standard deviation of amount of time session remained valid
  - isCheckingRemoteSessionIdEncoding
```
@ManagedAttribute("check remote session id encoding")
public boolean isCheckingRemoteSessionIdEncoding()
```
    Returns:
    
    True if absolute URLs are check for remoteness before being session encoded.
  - setCheckingRemoteSessionIdEncoding
```
public void setCheckingRemoteSessionIdEncoding(boolean remote)
```
    Parameters:
    
    remote - True if absolute URLs are check for remoteness before being session encoded.
  - renewSessionId
```
public void renewSessionId(java.lang.String oldId,
                           java.lang.String oldExtendedId,
                           java.lang.String newId,
                           java.lang.String newExtendedId)
```
    Change the existing session id.
    
    Parameters:
    
    oldId - the old session id
    
    oldExtendedId - the session id including worker suffix
    
    newId - the new session id
    
    newExtendedId - the new session id including worker suffix
  - invalidate
```
public void invalidate(java.lang.String id)
```
    Called when a session has expired.
    
    Parameters:
    
    id - the id to invalidate
  - scavenge
```
public void scavenge()
```
    Called periodically by the HouseKeeper to handle the list of sessions that have expired since the last call to scavenge.
  - sessionInactivityTimerExpired
```
public void sessionInactivityTimerExpired(Session session)
```
    Each session has a timer that is configured to go off when either the session has not been accessed for a configurable amount of time, or the session itself has passed its expiry.
    
    Parameters:
    
    session -
  - isIdInUse
```
public boolean isIdInUse(java.lang.String id)
                  throws java.lang.Exception
```
    Check if id is in use by this context
    
    Parameters:
    
    id - identity of session to check
    
    Returns:
    
    true if this manager knows about this id
    
    Throws:
    
    java.lang.Exception
  - getScheduler
```
public org.eclipse.jetty.util.thread.Scheduler getScheduler()
```
  - doSessionAttributeListeners
```
public void doSessionAttributeListeners(Session session,
                                        java.lang.String name,
                                        java.lang.Object old,
                                        java.lang.Object value)
```
  - doScope
```
public void doScope(java.lang.String target,
                    Request baseRequest,
                    javax.servlet.http.HttpServletRequest request,
                    javax.servlet.http.HttpServletResponse response)
             throws java.io.IOException,
                    javax.servlet.ServletException
```
    Description copied from class: ScopedHandler
    
    Scope the handler
    Derived implementations should call ScopedHandler.nextScope(String, Request, HttpServletRequest, HttpServletResponse)
    
    Overrides:
    
    doScope in class ScopedHandler
    
    Throws:
    
    java.io.IOException
    
    javax.servlet.ServletException
  - doHandle
```
public void doHandle(java.lang.String target,
                     Request baseRequest,
                     javax.servlet.http.HttpServletRequest request,
                     javax.servlet.http.HttpServletResponse response)
              throws java.io.IOException,
                     javax.servlet.ServletException
```
    Description copied from class: ScopedHandler
    
    Do the handler work within the scope.
    Derived implementations should call ScopedHandler.nextHandle(String, Request, HttpServletRequest, HttpServletResponse)
    
    Specified by:
    
    doHandle in class ScopedHandler
    
    Throws:
    
    java.io.IOException
    
    javax.servlet.ServletException
  - checkRequestedSessionId
```
protected void checkRequestedSessionId(Request baseRequest,
                                       javax.servlet.http.HttpServletRequest request)
```
    Look for a requested session ID in cookies and URI parameters
    
    Parameters:
    
    baseRequest - the request to check
    
    request - the request to check
  - toString
```
public java.lang.String toString()
```
    Overrides:
    
    toString in class java.lang.Object
    
    See Also:
    
    Object.toString()

Class SessionHandler

Nested Class Summary

Nested classes/interfaces inherited from class org.eclipse.jetty.server.handler.AbstractHandler

Nested classes/interfaces inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle

Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.Container

Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.LifeCycle

Field Summary

Fields inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle

Fields inherited from class org.eclipse.jetty.server.handler.HandlerWrapper

Fields inherited from class org.eclipse.jetty.server.handler.ScopedHandler

Constructor Summary

Method Summary

Methods inherited from class org.eclipse.jetty.server.handler.AbstractHandler

Methods inherited from class org.eclipse.jetty.server.handler.AbstractHandlerContainer

Methods inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle

Methods inherited from class org.eclipse.jetty.util.component.ContainerLifeCycle

Methods inherited from class org.eclipse.jetty.server.handler.HandlerWrapper

Methods inherited from interface org.eclipse.jetty.util.component.LifeCycle

Methods inherited from class java.lang.Object

Methods inherited from class org.eclipse.jetty.server.handler.ScopedHandler

Field Detail

DEFAULT_TRACKING

__SessionCookieProperty

__DefaultSessionCookie

__SessionIdPathParameterNameProperty

__DefaultSessionIdPathParameterName

__CheckRemoteSessionEncoding

__SessionDomainProperty

__DefaultSessionDomain

__SessionPathProperty

__MaxAgeProperty

__defaultSessionTrackingModes

SESSION_LISTENER_TYPES

MAX_INACTIVE_MINUTES

_dftMaxIdleSecs

_httpOnly

_sessionIdManager

_secureCookies

_secureRequestOnly

_sessionAttributeListeners

_sessionListeners

_sessionIdListeners

_loader

_context

_sessionContext

_sessionCookie

_sessionIdPathParameterName

_sessionIdPathParameterNamePrefix

_sessionDomain

_sessionPath

_maxCookieAge

_refreshCookieAge

_nodeIdInSessionId

_checkingRemoteSessionIdEncoding

_sessionComment

_sessionCache

_sessionTimeStats

_sessionsCreatedStats

_sessionTrackingModes

_usingURLs

_usingCookies

_candidateSessionIdsForExpiry

_scheduler

_ownScheduler

Constructor Detail

SessionHandler

Method Detail

getSessionPath

getMaxCookieAge

access

addEventListener

clearEventListeners

complete

complete

doStart

doStop

getHttpOnly

getHttpSession

getSessionIdManager

getMaxInactiveInterval