Jersey中的会话变量（Java / JBoss）

Question

I'm developing a RESTful Web Service in Java with Jersey and JBoss and I need to store "Session variables" like in PHP. To mantain the session of a client but without using coockies.

@Context
private UriInfo context;

@Context
private HttpServletRequest httpRequest;

@Path("/firstPage")
@GET
@Consumes(MediaType.TEXT_PLAIN)
@Produces(MediaType.APPLICATION_JSON)
public String createInstance(@QueryParam("instance") String inst) 
        throws JSONException 
{
    // Here I "declare" the session variable
    HttpSession session = httpRequest.getSession(true);
    session.setAttribute("instance", inst);

    // Creation of the DTO (Data Transfer Object)
    JSONObject innerObj = new JSONObject();
    JSONObject outterObj = new JSONObject();

    innerObj.put("ContactID", "{{Contact.Id}}");
    innerObj.put("EmailAddress", "{{Contact.Field(C_EmailAddress)}}");
    outterObj.put("recordDefinition", innerObj);

    return outterObj.toString();
}

@Path("/secondPage")
@GET
@Consumes(MediaType.TEXT_PLAIN)
@Produces(MediaType.APPLICATION_JSON)
public String validateInstance(@QueryParam("instance") String inst) 
        throws JSONException 
{
    // Here I "validate" the session variable
    HttpSession session = httpRequest.getSession(true);
    if ((String)session.getAttribute("instance") == inst) {
        JSONObject obj= new JSONObject();

        outterObj.put("status", 200);
        outterObj.put("instance", inst);

        return obj.toString();
    } else {
        JSONObject obj = new JSONObject();
        obj.put("error", 401);
        return obj.toString();
    }
}

Here is what I did but it's not working as I expected. Any solution?

Answer 1

As somone already pointed out: Sessions are handled with a cookie that contains the session id which php uses to connect clients to sessions.

For your java rest service. per definition sessions are not part of rest services and even discouraged.

Please refer to the original document from field about the rest architecture: https://www.ics.uci.edu/~fielding/pubs/dissertation/rest_arch_style.htm

5.1.3 Stateless

We next add a constraint to the client-server interaction: communication must be stateless in nature, ... ach request from client to server must contain all of the information necessary to understand the request, and cannot take advantage of any stored context on the server. Session state is therefore kept entirely on the client.

Is there any reason against taking the created data along between requests and attach them to the second request?