email article printer friendly

Manage Sessions in Web Services
The two accepted techniques of managing session in a Web service are to rely on HTTP and use HTTP cookies, or to use SOAP headers. Axis lets you do both.
by Kevin Jones

Posted April 29, 2003

There is no standard way of managing session in a Web service, although there are two accepted techniques. The first is to rely on HTTP and use HTTP cookies. The second, and probably the most significant way, is to use SOAP headers. Axis lets developers do both.

Using HTTP managed sessions is the default in Axis. To do this from within a server is straightforward. Most management of an Axis Web service is done through an instance of org.apache.axis.MessageContext. Within an Axis Web service you get an instance of MessageContext by calling a static method on the MessageContext class:

public class SessionService
{
   public String echo(String in)
   {
      MessageContext mc = 
         MessageContext.getCurrentContext();

The MessageContext has a method called setMaintainSession, and calling this should enable sessions. However, at the time of writing (Axis 1.1 RC2) sessions aren't enabled until the session object is accessed, which means code something like this:

public class SessionService
{
   public String echo(String in)
   {
      MessageContext mc = MessageContext.
         getCurrentContext();
      Session session = mc.getSession();
      String name = (String)session.get("name");
      return in;
   }
}

This will cause the Axis framework to generate a set-cookie header:

Set-Cookie: 
JSESSIONID=49EBBB19A1B2F8D10EE075F6F14CB8C9; 
Path=/axissessions

A client needs to return this Cookie in a Cookie header to maintain the session. To do this from a client that uses the axis runtime, the client has to call the setMaintainSession method of the org.apache.axis.client.Service interface. This interface is implemented by the Locator class generated by the WSDL2Java generation tool. Once you call the method, the Axis framework will automatically return the cookie to the server:

   public static void main(String[] args)
   {
      UseSessionsServiceLocator locator = new 
         UseSessionsServiceLocator();
      locator.setMaintainSession(true);