Showing posts with label Session Management. Show all posts

Friday, 5 March 2021

Authentication vs. Authorization (Version 4) | Session and JWT Token based Authentication

🚀 Master App Security!

Subscribe to Ram N Java for simplified tutorials on Security, JWT, and Backend Architecture!

Authentication vs. Authorization: A Complete Guide

While often used interchangeably, Authentication and Authorization are two distinct pillars of application security. In this tutorial, we "simplify" these concepts and compare how Session-based and JWT Token-based methods handle them in real-world scenarios.

Key Differences & Methodologies

We break down the fundamental logic behind verifying identity versus managing permissions:

Authentication: The process of verifying "Who you are" (Login).
Authorization: The process of verifying "What you can do" (Permissions/Roles).
Session-Based Method: How stateful servers track users via session IDs and cookies.
JWT Token Method: The modern, stateless approach where the token itself carries identity and permission data.

Choosing the Right Security Model

For Java Developers and Backend Architects, understanding the trade-offs between these two methods is essential. We discuss why JWT is favored for scalable microservices and mobile APIs, while Sessions might still be used in traditional web apps. Mastering these concepts ensures you can build secure and efficient Identity Management systems.

The Foundation of Secure Apps

Get the conceptual clarity you need to design professional-grade authentication and authorization flows. Whether you're preparing for a Technical Interview or architecting a new system, this guide provides the essential knowledge to keep your users and data safe. Start your deep dive into Web Security today.

📥 Elevate Your Skills!

Watch the full comparison to master the nuances of AuthN and AuthZ. Subscribe to Ram N Java for more high-quality tech guides and simplified backend tutorials!

Friday, 24 April 2015

Servlets : Cookies Demo

🚀 Master Java Servlets & Web Development!

Subscribe to Ram N Java for clean Java tutorials, servlet session tracking guides, and step-by-step code demonstrations!

🔔 Subscribe to Ram N Java

Understanding Cookies in Java Servlets

HTTP is fundamentally a stateless protocol, meaning each client request is treated independently without built-in memory of previous interactions. To maintain client state across multiple HTTP requests, Java Servlets provide several session tracking mechanisms—one of the simplest and most widespread being Cookies. A cookie is a small piece of text data sent by a server to a web browser, stored locally on the client machine, and returned with subsequent requests.

Key Concepts & Lifecycle

javax.servlet.http.Cookie: The core Java class used to create, inspect, and configure cookies.
Name-Value Pair: Cookies are stored as key-value string pairs (e.g., Cookie cookie = new Cookie("user", "Ram")).
Adding Cookies to Response: The servlet adds the cookie to the HTTP response header using response.addCookie(cookie).
Reading Cookies from Request: On subsequent visits, the servlet reads incoming cookies from the HTTP request header using request.getCookies(), which returns an array of Cookie[] objects.
Max Age & Expiration: Control persistence using cookie.setMaxAge(seconds). Setting a positive value makes it a persistent cookie, while negative or zero values control session-only or deletion behavior.

Step-by-Step Implementation Flow

Instantiate the Cookie: Create a new Cookie instance specifying the key and value strings.
Configure Cookie Properties: Set optional attributes such as setMaxAge(), setPath(), or setDomain().
Send Cookie to Client: Call response.addCookie(cookie) before writing response content.
Retrieve Cookies in Another Servlet: Call request.getCookies() to get the array of cookies and iterate through them to locate your target cookie by cookie.getName() and retrieve its data via cookie.getValue().

Benefits of Cookie-Based Session Tracking

Client-Side Storage: Minimizes server-side memory overhead since state information is preserved on the user's browser.
Simple Implementation: Straightforward API built directly into the standard Java Servlet specification without external dependencies.
Customizable Lifespan: Easy to configure whether data lasts only for the browser session or persists across browser restarts.

Saturday, 21 June 2014

Servlets : HttpSession Listener Demo [Count logged in Users]

Master Core Java & Servlets!

Subscribe to Ram N Java for beginner-friendly coding walkthroughs, web architecture lessons, and hands-on Java guides!

🔔 Subscribe to Ram N Java

Tracking Logged-In Users with HttpSessionListener

In Java web applications, tracking the number of active sessions or concurrent logged-in users is a common requirement for dashboards, system monitoring, and session management. The standard, cleanest way to achieve this is by implementing the HttpSessionListener interface.

The web container automatically triggers callback methods on HttpSessionListener whenever a new HTTP session is created or an existing session is invalidated or times out. By updating a counter stored in the application-wide ServletContext, you can maintain an accurate, real-time count of active users.

How the Listener Works

The HttpSessionListener interface defines two primary lifecycle methods:

sessionCreated(HttpSessionEvent se): Invoked automatically when a new user session is initiated. Here, you increment the active user counter.
sessionDestroyed(HttpSessionEvent se): Invoked when a user logs out (session invalidated) or when the session expires due to inactivity. Here, you decrement the counter.

@WebListener

    public class UserCounterListener implements HttpSessionListener {

        private static int activeUsers = 0;


        public void sessionCreated(HttpSessionEvent se) {

            activeUsers++;

            se.getSession().getServletContext().setAttribute("activeUsers", activeUsers);

        }


        public void sessionDestroyed(HttpSessionEvent se) {

            activeUsers--;

            se.getSession().getServletContext().setAttribute("activeUsers", activeUsers);

        }

    }

Key Advantages of Using HttpSessionListener

Automatic Session Lifecycle Management: No manual tracking or polling needed; the servlet container notifies the listener on lifecycle transitions.
Clean Separation: Decouples session analytics and user counting from individual business servlets.
Global Availability: Storing the count inside ServletContext makes it effortlessly accessible across all servlets, JSPs, and controllers.

Recommended Related Tutorials

Continue exploring servlet listeners and session handling with these tutorials from Ram N Java:

Click here to watch in Youtube : https://www.youtube.com/watch?v=fv8Idtevcg0

Click the below Image to Enlarge

HttpSessionListenerDemo Project Dir Structure

LoginServlet.java

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class LoginServlet extends HttpServlet
{
    
    private static final long serialVersionUID = 1L;

    public void init() throws ServletException
    {
        System.out.println("-----------------------------------------");
        System.out.println(" Init method is called in "
                + this.getClass().getName());
        System.out.println("--------------------------------------");
    }
    
    public void doGet( HttpServletRequest request, HttpServletResponse response )
            throws ServletException, IOException
    {

        response.setContentType("text/html");
        PrintWriter out = response.getWriter();

        String userName = request.getParameter("username");
        out.print("Welcome " + userName);

        HttpSession session = request.getSession();
        session.setAttribute("uname", userName);

        ServletContext ctx = getServletContext();
        int totalUsers = (Integer) ctx.getAttribute("totalusers");
        int currentUsers = (Integer) ctx.getAttribute("currentusers");
        
        out.print("<br>total users= " + totalUsers);
        out.print("<br>current users= " + currentUsers);

        out.print("<br><a href='logout'>logout</a>");

        out.close();
    }
    
    public void destroy()
    {
        System.out.println("-----------------------------------------");
        System.out.println(" destroy method is called in "
                + this.getClass().getName());
        System.out.println("-----------------------------------------");
    }

}

LogoutServlet.java

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class LogoutServlet extends HttpServlet
{

    private static final long serialVersionUID = 1L;

    public void doGet( HttpServletRequest request, HttpServletResponse response )
            throws ServletException, IOException
    {

        response.setContentType("text/html");
        PrintWriter out = response.getWriter();

        HttpSession session = request.getSession(false);
        session.invalidate();

        out.print("You are successfully logged out");

        out.close();
    }

}

CountUserListener.java

import javax.servlet.ServletContext;
import javax.servlet.http.HttpSessionEvent;
import javax.servlet.http.HttpSessionListener;

public class CountUserListener implements HttpSessionListener
{
    ServletContext ctx = null;
    static int     totalUserCount = 0, currentUserCount = 0;

    public void sessionCreated( HttpSessionEvent httpSessionEvent )
    {
        System.out.println("sessionCreated method has been called in "
                + this.getClass().getName());

        
        totalUserCount++;
        currentUserCount++;

        ctx = httpSessionEvent.getSession().getServletContext();
        
        ctx.setAttribute("totalusers", totalUserCount);
        ctx.setAttribute("currentusers", currentUserCount);

    }

    public void sessionDestroyed( HttpSessionEvent httpSessionEvent )
    {
        
        System.out.println("sessionDestroyed method has been called in "
                + this.getClass().getName());       
        currentUserCount--;
        ctx.setAttribute("currentusers", currentUserCount);
    }

}

web.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    metadata-complete="true" version="3.0">
    <display-name>HttpSessionListenerDemo</display-name>
    <description>
        This is a simple web application with a source code organization
        based on the recommendations of the Application Developer's Guide.
    </description>


    <servlet>
        <servlet-name>LoginServlet</servlet-name>
        <servlet-class>LoginServlet</servlet-class>
    </servlet>
    
    <servlet>
        <servlet-name>LogoutServlet</servlet-name>
        <servlet-class>LogoutServlet</servlet-class>
    </servlet>


    <servlet-mapping>
        <servlet-name>LoginServlet</servlet-name>
        <url-pattern>/login</url-pattern>
    </servlet-mapping>
    
    <servlet-mapping>
        <servlet-name>LogoutServlet</servlet-name>
        <url-pattern>/logout</url-pattern>
    </servlet-mapping>


    <listener>
        <listener-class>CountUserListener</listener-class>
    </listener>
    
</web-app>

index.html

<form action="login">
    Name:<input type="text" name="username"><br> 
    
    Password:<input type="password" name="password"><br> 
    
    <input type="submit" value="login" />
    
</form>

Environment Used

JDK version :1.7.0_51
Tomcat version : 7.0.50

To Download HttpSessionListenerCountUserDemoApp Project Click the below link

https://sites.google.com/site/javaee4321/servlets/HttpSessionListenerCountUserDemoApp.zip?attredirects=0&d=1

See also:

Servlets Tutorial

All Design Patterns Links

Servlets : HttpSessionBindinglistener Demo

Master Core Java & Servlets!

Subscribe to Ram N Java for beginner-friendly coding walkthroughs, session management tutorials, and hands-on Java guides!

🔔 Subscribe to Ram N Java

What is HttpSessionBindingListener?

In Java web applications, the HttpSessionBindingListener interface (from the javax.servlet.http package) enables an object to be notified whenever it is bound to or unbound from an HttpSession.

Unlike other listeners, HttpSessionBindingListener is implemented directly on the JavaBean / model class itself rather than configured separately as a standalone listener in web.xml or with @WebListener. This allows the object itself to manage its own lifecycle when placed into or removed from user session scope.

Core Lifecycle Methods

The HttpSessionBindingListener interface provides two callback methods:

valueBound(HttpSessionBindingEvent event): Triggered automatically when the object is added to a session via session.setAttribute("key", object).
valueUnbound(HttpSessionBindingEvent event): Triggered automatically when the object is removed from a session via session.removeAttribute("key"), replaced by another object, or when the session is invalidated or expires.

public class User implements HttpSessionBindingListener {

        private String username;


        public User(String username) {

            this.username = username;

        }


        @Override

        public void valueBound(HttpSessionBindingEvent event) {

            System.out.println(username + " is logged in (bound to session).");

        }


        @Override

        public void valueUnbound(HttpSessionBindingEvent event) {

            System.out.println(username + " is logged out (unbound from session).");

        }

    }

Key Advantages & Differences

No Deployment Descriptor Registration: You do not need to register the class in web.xml or use @WebListener; it activates automatically upon being bound to a session.
Self-Contained Cleanup: The object can safely release its own resources, close open handles, or update database statuses when a user logs out or times out.
Granular Tracking: Unlike HttpSessionAttributeListener which listens to all session attributes globally, this listener only tracks the specific object implementing it.

Recommended Related Tutorials

Continue exploring servlet listeners and session handling with these tutorials from Ram N Java:

Click here to watch in Youtube : https://www.youtube.com/watch?v=DquotVucWWQ

Click the below Image to Enlarge

HttpSessionBindingListenerDemo Project Dir Structure

HttpSessionAttributeTestServlet.java

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class HttpSessionAttributeTestServlet extends HttpServlet
{
    private static final long serialVersionUID = 1L;

    public void init() throws ServletException
    {
        System.out.println("-----------------------------------------");
        System.out.println(" Init method is called in "
                + this.getClass().getName());
        System.out.println("--------------------------------------");
    }

    public void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException
    {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();

        HttpSession httpSession = request.getSession();

        sleep();

        User user = new User("Ram", 43);
        httpSession.setAttribute("userinfo", user);

        sleep();

        httpSession.invalidate();

        out.println("This is the example of HttpSessionBindingListener");

    }

    private void sleep()
    {
        try
        {
            Thread.sleep(10000);
        }
        catch (InterruptedException e)
        {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }

    public void destroy()
    {
        System.out.println("-----------------------------------------");
        System.out.println(" destroy method is called in "
                + this.getClass().getName());
        System.out.println("-----------------------------------------");
    }

}

User.java

import javax.servlet.http.HttpSessionBindingEvent;
import javax.servlet.http.HttpSessionBindingListener;

public class User implements HttpSessionBindingListener
{

    private String name;
    private int age;

    public User(String name, int age)
    {
        super();
        this.name = name;
        this.age = age;
    }

    public User(String name)
    {
        this.name = name;
    }

    public String getName()
    {
        return name;
    }

    public void setName(String name)
    {
        this.name = name;
    }

    public int getAge()
    {
        return age;
    }

    public void setAge(int age)
    {
        this.age = age;
    }

    @Override
    public void valueBound(HttpSessionBindingEvent httpSessionBindingEvent)
    {
        System.out.println("\n###################################\n");

        System.out.println("valueBound method has been called in "
                + this.getClass().getName());

        System.out.println("Added/Replaced Attribute Name ="
                + httpSessionBindingEvent.getName() + ",value = "
                + httpSessionBindingEvent.getValue());

        System.out.println("\n#####################################\n");

        /*
         * if particular Attribute is added/replaced, based on that if you want
         * to perform any operation then you can do it here.
         */

    }

    @Override
    public void valueUnbound(HttpSessionBindingEvent httpSessionBindingEvent)
    {
        System.out.println("\n###################################\n");

        System.out.println("valueUnbound method has been called in "
                + this.getClass().getName());

        System.out.println("Removed Attribute Name ="
                + httpSessionBindingEvent.getName() + ",value = "
                + httpSessionBindingEvent.getValue());

        System.out.println("\n#####################################\n");

        /*
         * if particular Attribute is removed, based on that if you want to
         * perform any operation then you can do it here.
         */

    }

    @Override
    public String toString()
    {
        return "User [name=" + name + ", age=" + age + "]";
    }

}

web.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    metadata-complete="true" version="3.0">

    <display-name>HttpSessionBindingListenerDemo</display-name>

    <description>
        This is a simple web application with a source code organization
        based on the recommendations of the Application Developer's Guide.
    </description>

    <servlet>
        <servlet-name>HttpSessionAttributeTestServlet</servlet-name>
        <servlet-class>HttpSessionAttributeTestServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>HttpSessionAttributeTestServlet</servlet-name>
        <url-pattern>/listenerTest</url-pattern>
    </servlet-mapping>

</web-app>

index.html

<html>
<body>
    <a href="listenerTest">listenerTest</a>
</body>
</html>

Environment Used

JDK version :1.7.0_51
Tomcat version : 7.0.50

To Download HttpSessionBindingListenerDemoApp Project Click the below link

https://sites.google.com/site/javaee4321/servlets/HttpSessionBindingListenerDemoApp.zip?attredirects=0&d=1

See also:

Servlets Tutorial

All Design Patterns Links

Friday, 20 June 2014

Servlets : HttpSessionBindinglistener Introduction

Master Core Java & Servlets!

Subscribe to Ram N Java for beginner-friendly coding walkthroughs, session management tutorials, and hands-on Java guides!

🔔 Subscribe to Ram N Java

Introduction to HttpSessionBindingListener

In Java web applications, the HttpSessionBindingListener interface belongs to the javax.servlet.http package. It allows a Java object to be notified whenever it is bound to or unbound from an HTTP session.

Unlike global listeners that monitor session-wide or application-wide events, HttpSessionBindingListener is unique: it is implemented directly by the object (JavaBean/POJO) itself. When an instance of that object is placed into or removed from an HttpSession, the servlet container automatically triggers the corresponding lifecycle callback methods on that object.

The Two Callback Methods

The interface defines two essential methods that allow an object to manage its own lifecycle inside a user session:

valueBound(HttpSessionBindingEvent event): Invoked automatically when the object is added to an HTTP session using session.setAttribute(name, object). This is typically used to initialize session-specific resources or log a user login event.
valueUnbound(HttpSessionBindingEvent event): Invoked automatically when the object is removed via session.removeAttribute(name), replaced with another attribute, or when the session is invalidated or expires. This is ideal for cleaning up resources or updating active user state.

public class UserBean implements HttpSessionBindingListener {

        private String username;


        public void valueBound(HttpSessionBindingEvent event) {

            System.out.println("Object bound to session: " + event.getName());

        }


        public void valueUnbound(HttpSessionBindingEvent event) {

            System.out.println("Object unbound from session: " + event.getName());

        }

    }

Key Features of HttpSessionBindingListener

No Configuration Required: You do not need to register this listener in web.xml or annotate it with @WebListener. It works automatically when the object is placed in session scope.
Object-Level Granularity: While HttpSessionAttributeListener listens to every attribute change in the session, HttpSessionBindingListener notifies only the specific object that implements it.
Self-Contained State: Ideal for managing user session state, releasing dedicated connection handles, or tracking individual active logins.

Friday, 5 March 2021

Authentication vs. Authorization (Version 4) | Session and JWT Token based Authentication

🚀 Master App Security!

Authentication vs. Authorization: A Complete Guide

Key Differences & Methodologies

Choosing the Right Security Model

The Foundation of Secure Apps

📥 Elevate Your Skills!

Friday, 24 April 2015

Servlets : Cookies Demo

🚀 Master Java Servlets & Web Development!

Understanding Cookies in Java Servlets

Key Concepts & Lifecycle

Step-by-Step Implementation Flow

Benefits of Cookie-Based Session Tracking

Recommended Next Videos

Saturday, 21 June 2014

Servlets : HttpSession Listener Demo [Count logged in Users]

Master Core Java & Servlets!

Tracking Logged-In Users with HttpSessionListener

How the Listener Works

Key Advantages of Using HttpSessionListener

Recommended Related Tutorials

Servlets : HttpSessionBindinglistener Demo

Master Core Java & Servlets!

What is HttpSessionBindingListener?

Core Lifecycle Methods

Key Advantages & Differences

Recommended Related Tutorials

Friday, 20 June 2014

Servlets : HttpSessionBindinglistener Introduction

Master Core Java & Servlets!

Introduction to HttpSessionBindingListener

The Two Callback Methods

Key Features of HttpSessionBindingListener

Recommended Related Tutorials

Tutorials