简体繁体 English

HttpSession ID有多独特？

[英]How unique is the HttpSession ID?

原文 2012-10-21 13:16:42 0 2 java/ session/ servlets/ session-cookies

I am going to uniquely identify a user by storing a unique ID in his/her cookie. 我将通过在他/她的cookie中存储唯一ID来唯一地标识用户。 HttpSession ID is a good choice from my google search. HttpSession ID是我谷歌搜索的不错选择。 Just wanted to know how unique it is ? 只是想知道它有多独特？ Is it unique to the webcontainer or once it expires , will it get regenerated ? 它是否是Web容器的独特之处，或者一旦它过期，它会被重新生成吗？ If it repeats, all my user login can go for a toss.Need some expert opinion on using sessonID as a unique identifier for my users. 如果它重复，我的所有用户登录都可以进行折腾。需要一些专家意见使用sessonID作为我的用户的唯一标识符。

2 个解决方案

Session IDs are unique and meaningful only for the lifetime of a session. 会话ID仅在会话的生命周期内是唯一且有意义的。 A session ID identifies a session: nothing more, nothing less. 会话ID标识会话：仅此而已。 It does not identify a user. 它不识别用户。

You cannot and should not rely on session IDs ever being reused, let alone for the same user. 您不能也不应该依赖会话ID重复使用，更不用说同一个用户了。

A session ID must uniquely identify a session on a server, or on a cluster of servers. 会话ID必须唯一标识服务器或服务器群集上的会话。 You don't have any guarantee of uniqueness across restarts. 重启后，您无法保证唯一性。 Why don't you simply use a database sequence, or a UUID ? 为什么不简单地使用数据库序列或UUID ？