You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by sol myr <so...@yahoo.com> on 2011/03/20 09:53:02 UTC
Session timeouts: ignore "periodic polling" URL?
Hi,
We have a Servelts/JSP application Tomcat6.
Our javascripts issues automatic, periodic polling requests (Ajax and Comet), in order to keep the view up-to-date.
Unfortunately this prevents sessions from timing out...
Is there a way to tell Tomcat that some URL shouldn't affect session timeouts?
Namely if for the last 30 minutes, the browser requested nothing but "http://server/autoRefresh.do" , then Tomcat should assume the user went away from the computer, and kill the session.
Thanks :)
Re: Session timeouts: ignore "periodic polling" URL?
Posted by Mark Thomas <ma...@apache.org>.
On 21/03/2011 08:52, Felix Schumacher wrote:
> On Sun, 20 Mar 2011 22:26:46 +0100, André Warnier wrote:
You are both right on some counts and both wrong on some counts.
The Servlet spec (section 7.6 in Servlet 3.0) requires that processing a
request associated with a session (i.e. has a session ID) updates the
sessions access time.
Since this is can be viewed as inefficient, it is disabled by default.
In 5.5.x and 6.0.x it is enabled by the use of the
org.apache.catalina.STRICT_SERVLET_COMPLIANCE system property.
In Tomcat 7.0.x, there is a separate
org.apache.catalina.core.StandardHostValve.ACCESS_SESSION property
although the default is changed by
org.apache.catalina.STRICT_SERVLET_COMPLIANCE
This is all documented in the Tomcat 6 and Tomcat 7 docs:
http://tomcat.apache.org/tomcat-6.0-doc/config/systemprops.html
http://tomcat.apache.org/tomcat-7.0-doc/config/systemprops.html
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Session timeouts: ignore "periodic polling"URL?
Posted by Felix Schumacher <fe...@internetallee.de>.
On Sun, 20 Mar 2011 22:26:46 +0100, André Warnier wrote:
> Felix Schumacher wrote:
> ...
>
>>>
>>> The creation or retrieval of a session, as far as I understand it,
>>> is
>>> totally under application control.
>>> In other words, if your servlet (or JSP), when it is called,
>>> executes
>>> a HttpServletRequest.getSession() call, then it will retrieve the
>>> existing session (or create one if none exists yet); and if it does
>>> not call getSession(), it will not.
>
>> If the browser sends a session-id, tomcat will touch the session and
>> mark it as alive.
>> My response above was made on the base of the Servlet Specification
>> and the Javadoc of HttpRequest.getSession(). I am not versed enough
>> in the specifics of the Tomcat code to contradict what you say above.
> But I remain unconvinced. It sounds illogical that the container
> would go look for the session, before it is explicitly asked to do
> so.
You are right. I tested it with three simple files. First set an
attribute in the session and redirects after 45 seconds to a second
page. That page requests no session at all and redirects after 45
seconds to a third page. That page requests a session and tries to
display the set attribute.
As you suspected, it fails to display the attribute (when session
timeout is set to on minute :)
So the session is only refreshed (at least with my tested tomcat
6.0.32) when a session is requested by a servlet.
So I suspect the OP is requesting a session within his ajax-requests.
If he is requesting a session, the thread I mentioned in my earlier
post, could help him.
Thanks for correcting me
Felix
>
> So we need a real Tomcat expert here.
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Session timeouts: ignore "periodic polling" URL?
Posted by André Warnier <aw...@ice-sa.com>.
Felix Schumacher wrote:
...
>>
>> The creation or retrieval of a session, as far as I understand it, is
>> totally under application control.
>> In other words, if your servlet (or JSP), when it is called, executes
>> a HttpServletRequest.getSession() call, then it will retrieve the
>> existing session (or create one if none exists yet); and if it does
>> not call getSession(), it will not.
> If the browser sends a session-id, tomcat will touch the session and
> mark it as alive.
>
My response above was made on the base of the Servlet Specification and the Javadoc of
HttpRequest.getSession(). I am not versed enough in the specifics of the Tomcat code to
contradict what you say above.
But I remain unconvinced. It sounds illogical that the container would go look for the
session, before it is explicitly asked to do so.
So we need a real Tomcat expert here.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Session timeouts: ignore "periodic polling" URL?
Posted by Martin Gainty <mg...@hotmail.com>.
<!-- ==================== Default Session Configuration ================= -->
<!-- You can set the default session timeout (in minutes) for all newly created sessions by modifying the value in web.xml -->
<session-config>
<session-timeout>30</session-timeout>
</session-config>
regards,
Martin
______________________________________________
Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité
Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfaenger sein, so bitten wir hoeflich um eine Mitteilung. Jede unbefugte Weiterleitung oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht dient lediglich dem Austausch von Informationen und entfaltet keine rechtliche Bindungswirkung. Aufgrund der leichten Manipulierbarkeit von E-Mails koennen wir keine Haftung fuer den Inhalt uebernehmen.
Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas le destinataire prévu, nous te demandons avec bonté que pour satisfaire informez l'expéditeur. N'importe quelle diffusion non autorisée ou la copie de ceci est interdite. Ce message sert à l'information seulement et n'aura pas n'importe quel effet légalement obligatoire. Étant donné que les email peuvent facilement être sujets à la manipulation, nous ne pouvons accepter aucune responsabilité pour le contenu fourni.
> Date: Sun, 20 Mar 2011 21:14:43 +0100
> From: felix.schumacher@internetallee.de
> To: users@tomcat.apache.org
> Subject: Re: Session timeouts: ignore "periodic polling" URL?
>
> On Sun, 20 Mar 2011 15:40:48 +0100, André Warnier wrote:
> > sebb wrote:
> >> On 20 March 2011 11:19, André Warnier <aw...@ice-sa.com> wrote:
> >>> sol myr wrote:
> >>>> Hi,
> >>>>
> >>>> We have a Servelts/JSP application Tomcat6.
> >>>> Our javascripts issues automatic, periodic polling requests (Ajax
> >>>> and
> >>>> Comet), in order to keep the view up-to-date.
> >>>> Unfortunately this prevents sessions from timing out...
> >>>>
> >>>> Is there a way to tell Tomcat that some URL shouldn't affect
> >>>> session
> >>>> timeouts?
> >>>> Namely if for the last 30 minutes, the browser requested nothing
> >>>> but
> >>>> "http://server/autoRefresh.do" , then Tomcat should assume the
> >>>> user went
> >>>> away from the computer, and kill the session.
> >>>>
> >>> You may have to explain the logic of this a bit better, because on
> >>> the face
> >>> of it, it makes no sense.
> >>> Presumably, if you create a session, it is because the application
> >>> needs a
> >>> session (aka, needs some information to be preserved between
> >>> individual
> >>> requests of the same user/browser).
> >>> Then why would you want it to time out ?
> >> This is the sort of behaviour one wants for online banking - the
> >> session should be logged out if the user does not do anything for a
> >> while, even though the page may be doing background requests.
> >>
> >
> > Allright then, I'll buy that, if somewhat reluctantly.
> >
> > The creation or retrieval of a session, as far as I understand it, is
> > totally under application control.
> > In other words, if your servlet (or JSP), when it is called, executes
> > a HttpServletRequest.getSession() call, then it will retrieve the
> > existing session (or create one if none exists yet); and if it does
> > not call getSession(), it will not.
> If the browser sends a session-id, tomcat will touch the session and
> mark it as alive.
>
> I remember a similar thread not long ago, but I can't find it in the
> archives. I could
> find a similar thread from 2008 where Christopher gave some answers to
> this problem[1].
>
> If OP knows the url-pattern for all its ajax-request, that should be
> ignored for
> session-keepalive, the parameter in the filter could be dropped. He
> would just have to
> limit the filter to that url.
>
> Regards
> Felix
>
> [1]
> http://old.nabble.com/Session-expiration-and-AJAX-issues-td15671248.html
> >
> > In other words, if you want some requests URLs "not to count" (or "be
> > excluded") as far as the session mechanism is concerned, then you
> > just
> > have to map these requests (URLs) to a servlet/JSP page which does
> > not
> > do a getSession().
> >
> > Of course, if in order to refresh the information in the browser
> > page, the application needs to access information stored in the
> > session, then you have a problem.
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
Re: Session timeouts: ignore "periodic polling"URL?
Posted by Felix Schumacher <fe...@internetallee.de>.
On Sun, 20 Mar 2011 15:40:48 +0100, André Warnier wrote:
> sebb wrote:
>> On 20 March 2011 11:19, André Warnier <aw...@ice-sa.com> wrote:
>>> sol myr wrote:
>>>> Hi,
>>>>
>>>> We have a Servelts/JSP application Tomcat6.
>>>> Our javascripts issues automatic, periodic polling requests (Ajax
>>>> and
>>>> Comet), in order to keep the view up-to-date.
>>>> Unfortunately this prevents sessions from timing out...
>>>>
>>>> Is there a way to tell Tomcat that some URL shouldn't affect
>>>> session
>>>> timeouts?
>>>> Namely if for the last 30 minutes, the browser requested nothing
>>>> but
>>>> "http://server/autoRefresh.do" , then Tomcat should assume the
>>>> user went
>>>> away from the computer, and kill the session.
>>>>
>>> You may have to explain the logic of this a bit better, because on
>>> the face
>>> of it, it makes no sense.
>>> Presumably, if you create a session, it is because the application
>>> needs a
>>> session (aka, needs some information to be preserved between
>>> individual
>>> requests of the same user/browser).
>>> Then why would you want it to time out ?
>> This is the sort of behaviour one wants for online banking - the
>> session should be logged out if the user does not do anything for a
>> while, even though the page may be doing background requests.
>>
>
> Allright then, I'll buy that, if somewhat reluctantly.
>
> The creation or retrieval of a session, as far as I understand it, is
> totally under application control.
> In other words, if your servlet (or JSP), when it is called, executes
> a HttpServletRequest.getSession() call, then it will retrieve the
> existing session (or create one if none exists yet); and if it does
> not call getSession(), it will not.
If the browser sends a session-id, tomcat will touch the session and
mark it as alive.
I remember a similar thread not long ago, but I can't find it in the
archives. I could
find a similar thread from 2008 where Christopher gave some answers to
this problem[1].
If OP knows the url-pattern for all its ajax-request, that should be
ignored for
session-keepalive, the parameter in the filter could be dropped. He
would just have to
limit the filter to that url.
Regards
Felix
[1]
http://old.nabble.com/Session-expiration-and-AJAX-issues-td15671248.html
>
> In other words, if you want some requests URLs "not to count" (or "be
> excluded") as far as the session mechanism is concerned, then you
> just
> have to map these requests (URLs) to a servlet/JSP page which does
> not
> do a getSession().
>
> Of course, if in order to refresh the information in the browser
> page, the application needs to access information stored in the
> session, then you have a problem.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Session timeouts: ignore "periodic polling" URL?
Posted by Stevo Slavić <ss...@gmail.com>.
If ajax requests need session state, then IMO Tomcat can not help you
with that - it can not and should not differentiate requests issued by
ajax and requests issued by user. In that case one solution would be
to logout user with a logout request after timeout. Where ajax
requests live, javascript is enabled, so on page load you can just
https://developer.mozilla.org/en/DOM/window.setTimeout to logout
request, where client side timeout duration could/should be same as
server side session timeout.
Regards,
Stevo.
On Sun, Mar 20, 2011 at 3:40 PM, André Warnier <aw...@ice-sa.com> wrote:
> sebb wrote:
>>
>> On 20 March 2011 11:19, André Warnier <aw...@ice-sa.com> wrote:
>>>
>>> sol myr wrote:
>>>>
>>>> Hi,
>>>>
>>>> We have a Servelts/JSP application Tomcat6.
>>>> Our javascripts issues automatic, periodic polling requests (Ajax and
>>>> Comet), in order to keep the view up-to-date.
>>>> Unfortunately this prevents sessions from timing out...
>>>>
>>>> Is there a way to tell Tomcat that some URL shouldn't affect session
>>>> timeouts?
>>>> Namely if for the last 30 minutes, the browser requested nothing but
>>>> "http://server/autoRefresh.do" , then Tomcat should assume the user went
>>>> away from the computer, and kill the session.
>>>>
>>> You may have to explain the logic of this a bit better, because on the
>>> face
>>> of it, it makes no sense.
>>> Presumably, if you create a session, it is because the application needs
>>> a
>>> session (aka, needs some information to be preserved between individual
>>> requests of the same user/browser).
>>> Then why would you want it to time out ?
>>
>> This is the sort of behaviour one wants for online banking - the
>> session should be logged out if the user does not do anything for a
>> while, even though the page may be doing background requests.
>>
>
> Allright then, I'll buy that, if somewhat reluctantly.
>
> The creation or retrieval of a session, as far as I understand it, is
> totally under application control.
> In other words, if your servlet (or JSP), when it is called, executes a
> HttpServletRequest.getSession() call, then it will retrieve the existing
> session (or create one if none exists yet); and if it does not call
> getSession(), it will not.
>
> In other words, if you want some requests URLs "not to count" (or "be
> excluded") as far as the session mechanism is concerned, then you just have
> to map these requests (URLs) to a servlet/JSP page which does not do a
> getSession().
>
> Of course, if in order to refresh the information in the browser page, the
> application needs to access information stored in the session, then you have
> a problem.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Session timeouts: ignore "periodic polling" URL?
Posted by André Warnier <aw...@ice-sa.com>.
sebb wrote:
> On 20 March 2011 11:19, André Warnier <aw...@ice-sa.com> wrote:
>> sol myr wrote:
>>> Hi,
>>>
>>> We have a Servelts/JSP application Tomcat6.
>>> Our javascripts issues automatic, periodic polling requests (Ajax and
>>> Comet), in order to keep the view up-to-date.
>>> Unfortunately this prevents sessions from timing out...
>>>
>>> Is there a way to tell Tomcat that some URL shouldn't affect session
>>> timeouts?
>>> Namely if for the last 30 minutes, the browser requested nothing but
>>> "http://server/autoRefresh.do" , then Tomcat should assume the user went
>>> away from the computer, and kill the session.
>>>
>> You may have to explain the logic of this a bit better, because on the face
>> of it, it makes no sense.
>> Presumably, if you create a session, it is because the application needs a
>> session (aka, needs some information to be preserved between individual
>> requests of the same user/browser).
>> Then why would you want it to time out ?
>
> This is the sort of behaviour one wants for online banking - the
> session should be logged out if the user does not do anything for a
> while, even though the page may be doing background requests.
>
Allright then, I'll buy that, if somewhat reluctantly.
The creation or retrieval of a session, as far as I understand it, is totally under
application control.
In other words, if your servlet (or JSP), when it is called, executes a
HttpServletRequest.getSession() call, then it will retrieve the existing session (or
create one if none exists yet); and if it does not call getSession(), it will not.
In other words, if you want some requests URLs "not to count" (or "be excluded") as far as
the session mechanism is concerned, then you just have to map these requests (URLs) to a
servlet/JSP page which does not do a getSession().
Of course, if in order to refresh the information in the browser page, the application
needs to access information stored in the session, then you have a problem.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Session timeouts: ignore "periodic polling" URL?
Posted by sebb <se...@gmail.com>.
On 20 March 2011 11:19, André Warnier <aw...@ice-sa.com> wrote:
> sol myr wrote:
>>
>> Hi,
>>
>> We have a Servelts/JSP application Tomcat6.
>> Our javascripts issues automatic, periodic polling requests (Ajax and
>> Comet), in order to keep the view up-to-date.
>> Unfortunately this prevents sessions from timing out...
>>
>> Is there a way to tell Tomcat that some URL shouldn't affect session
>> timeouts?
>> Namely if for the last 30 minutes, the browser requested nothing but
>> "http://server/autoRefresh.do" , then Tomcat should assume the user went
>> away from the computer, and kill the session.
>>
> You may have to explain the logic of this a bit better, because on the face
> of it, it makes no sense.
> Presumably, if you create a session, it is because the application needs a
> session (aka, needs some information to be preserved between individual
> requests of the same user/browser).
> Then why would you want it to time out ?
This is the sort of behaviour one wants for online banking - the
session should be logged out if the user does not do anything for a
while, even though the page may be doing background requests.
> And if you don't need a session, then why do you create one ?
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Session timeouts: ignore "periodic polling" URL?
Posted by André Warnier <aw...@ice-sa.com>.
sol myr wrote:
> Hi,
>
> We have a Servelts/JSP application Tomcat6.
> Our javascripts issues automatic, periodic polling requests (Ajax and Comet), in order to keep the view up-to-date.
> Unfortunately this prevents sessions from timing out...
>
> Is there a way to tell Tomcat that some URL shouldn't affect session timeouts?
> Namely if for the last 30 minutes, the browser requested nothing but "http://server/autoRefresh.do" , then Tomcat should assume the user went away from the computer, and kill the session.
>
You may have to explain the logic of this a bit better, because on the face of it, it
makes no sense.
Presumably, if you create a session, it is because the application needs a session (aka,
needs some information to be preserved between individual requests of the same user/browser).
Then why would you want it to time out ?
And if you don't need a session, then why do you create one ?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org