Session Related Interview Questions
Question: What is a Session?
Answer: A Session refers to all the request that a single client makes to
a server. A session is specific to the user and for each user a new session is
created to track all the request from that user. Every user has a separate
session and separate session variable is associated with that session. In case
of web applications the default time-out value for session variable is 20
minutes, which can be changed as per the requirement.
Question: What is Session ID?
Answer: A session ID is an unique identification string usually a long,
random and alpha-numeric string, that is transmitted between the client and the server. Session IDs are
usually stored in the cookies, URLs (in case url rewriting) and hidden fields of Web pages.
Question: What is Session Tracking?
Answer: HTTP is stateless protocol and it does not maintain the client
state. But there exist a mechanism called "Session Tracking" which
helps the servers to maintain the state to track the series of requests from the
same user across some period of time.
Question: What are different types of
Session Tracking?
Answer: Mechanism for Session Tracking are:
a) Cookies
b) URL rewriting
c) Hidden form fields
d) SSL Sessions
Question: What is HTTPSession Class?
Answer: HttpSession Class provides a way to identify a user across across multiple request. The servlet container uses HttpSession interface to create a session between an HTTP client and an HTTP server. The session
lives only for a specified time period, across more than one connection or page request from the user.
Question: Why do u use Session Tracking in HttpServlet?
Answer: In HttpServlet you can use Session Tracking to track the user
state. Session is required if you are developing shopping cart application or in
any e-commerce application.
Question: What are the advantage of Cookies over
URL rewriting?
Answer: Sessions tracking using Cookies are more secure and fast. Session
tracking using Cookies can also be used with other mechanism of Session Tracking
like url rewriting.
Cookies are stored at client side so some clients may disable cookies so we may not sure that the
cookies may work or not.
In url rewriting requites large data transfer from and to the server. So, it leads to network traffic and access may be
become slow.
Question: What is session hijacking?
Answer: If you application is not very
secure then it is possible to get the access of system after acquiring or
generating the authentication information. Session hijacking refers to the act of taking control of a user session after successfully obtaining or generating an authentication session ID.
It involves an attacker using captured, brute forced or reverse-engineered session IDs to
get a control of a legitimate user's Web application session while that session is still in progress.
Question: What is Session Migration?
Answer: Session Migration is a mechanism of moving the session from one
server to another in case of server failure. Session Migration can be implemented
by:
a) Persisting the session into database
b) Storing the session in-memory on multiple servers.
Question: How to track a user session in Servlets?
Answer: The interface HttpSession can be used to track the session in the
Servlet. Following code can be used to create session object in the Servlet: HttpSession session =
req.getSession(true);
Question: How you can destroy the session in
Servlet?
Answer: You can call invalidate() method on the session object to destroy
the session. e.g. session.invalidate();