29.01.2013 Views

WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

The following sections outline the planning considerations for each.<br />

Note: Before finishing your session management planning, review the article<br />

Sessions in the Information Center at the following Web page:<br />

http://publib.boulder.ibm.com/infocenter/wasinfo/v7r0/topic/com.ibm.<br />

websphere.nd.doc/info/ae/ae/cprs_sess.html<br />

<strong>Application</strong> design<br />

Although using session information is a convenient method for the developer, this<br />

usage should be minimized. Only objects really needed for processing of<br />

subsequent requests should be stored in the session. If sessions are persisted<br />

during runtime, there is a performance impact if the session data is too big.<br />

Session tracking mechanism<br />

You can choose to use cookies, URL rewriting, SSL session IDs, or a<br />

combination of these as the mechanism for managing session IDs.<br />

Cookies<br />

Using cookies as a session tracking mechanism is common. <strong>WebSphere</strong> session<br />

management generates a unique session ID and returns it to the user’s Web<br />

browser to be stored as a cookie.<br />

URL rewriting<br />

URL rewriting requires the developer to use special encoding APIs and to set up<br />

the site page flow to avoid losing the encoded information. The session identifier<br />

is stored in the page returned to the user. <strong>WebSphere</strong> encodes the session<br />

identifier as a parameter on URLs that have been encoded programmatically by<br />

the Web application developer.<br />

URL rewriting can only be used for pages that are dynamically generated for<br />

each request, such as pages generated by servlets or JSPs. If a static page is<br />

used in the session flow the session information is lost. URL rewriting forces the<br />

site designer to plan the user’s flow in the site to avoid losing their session ID.<br />

SSL ID tracking<br />

With SSL ID tracking, SSL session information is used to track the session ID.<br />

Because the SSL session ID is negotiated between the Web browser and an<br />

HTTP server, it cannot survive an HTTP server failure. However, the failure of an<br />

application server does not affect the SSL session ID. In environments that use<br />

<strong>WebSphere</strong> components with multiple HTTP servers, you must use an affinity<br />

mechanism for the Web servers when SSL session ID is used as the session<br />

tracking mechanism.<br />

262 <strong>WebSphere</strong> <strong>Application</strong> <strong>Server</strong> <strong>V7.0</strong>: <strong>Concepts</strong>, Planning, and Design

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!