[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
|
Re: [servlet-dev] WebSocket and HttpSession
|
On 08/06/2023 17:10, Manfred Riem wrote:
Hi Mark,
Once you do a protocol upgrade one should not try to use anything that had to do with the original Servlet request.
If someone wants 'session' management then they should implement that as part of their WebSocket application.
Ideally, yes. Unfortunately that breaks down if access to the WebSocket
endpoint is authenticated as the original HTTP request is then
authenticated and that authentication process is linked to the HTTP session.
There are lots of different strategies for handling this. I'm not
advocating for any one strategy. I am aiming for the minimal change to
the Servlet and/or WebSocket specs that would allow developers to
implement their strategy of choice.
Mark
Anyway my 2 dollars (inflation and all)
Thanks!
Kind regards,
Manfred Riem
-----Original Message-----
From: servlet-dev <servlet-dev-bounces@xxxxxxxxxxx> On Behalf Of Mark Thomas
Sent: Thursday, June 8, 2023 10:58 AM
To: servlet developer discussions <servlet-dev@xxxxxxxxxxx>
Subject: [servlet-dev] WebSocket and HttpSession
Hi all,
I'd like to see if we can find a way to resolve a long standing WebSocket issue. The full detail can be found in this issue:
https://github.com/jakartaee/websocket/issues/175
The short version is that a WebSocket session that retains a reference to the Servlet HttpSession in place when the WebSocket handshake took place needs a way to indicate that it is using the session and that the session should not be invalidated for inactivity.
My proposal is to add the following method to HttpSession:
public void access()
Calling this method would update the last accessed time to the current time.
The circumstances in which a WebSocket application may call this method would be left as an application concern as different applications are likely to want to adopt different strategies.
Thoughts?
Mark
_______________________________________________
servlet-dev mailing list
servlet-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/servlet-dev
_______________________________________________
servlet-dev mailing list
servlet-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/servlet-dev
