different browsersessions share same instantiation?

[Forge <fo...@neonics.com>]

Hi there,

Why are class-level variables shared among different browser sessions?

When I put code like


	if (session==null)
		session=request.getSession();

in my xsp page, and I log in to my page and enter some data that is
stored in the session, someone else can open the same page on another
computer and see what I've entered. It seems that the generated
classfile is loaded once (not indicated by the logs, though), 
and is shared among all the connections made to Tomcat.

When i remove the if-clause all works fine, but it still strikes
me as a little bit odd, since for instance JServ does not have
this problem. When I close the browser and re-enter a site that
is servlet based with jserv, the session is lost. With cocoon/tomcat
however, the session is kept. (at least the xsp-page class
is kept in memory and is served to whoever asks for that page next).

Why, o why?

Greetings,

	Kenney



---------------------------------------------------------------------
Please check that your question has not already been answered in the
FAQ before posting. <http://xml.apache.org/cocoon/faqs.html>

To unsubscribe, e-mail: <co...@xml.apache.org>
For additional commands, e-mail: <co...@xml.apache.org>