Preventing tomcat to create sessions

[youssef.mohammed]

Hi;
I am writing set of REST services for some Flash clients, flash
doesn't send cookies and we don't want to user URL rewriting for most
of the services (they are just stateless).
The issue is when the client calls http://localhost/services/resource
say n times ... the application server/servlet container creates n
sessions !
How do i prevent that from happening ?

 

[Dave Miller]

Hi;
I am writing set of REST services for some Flash clients, flash
doesn't send cookies and we don't want to user URL rewriting for most
of the services (they are just stateless).
The issue is when the client calls http://localhost/services/resource
say n times ... the application server/servlet container creates n
sessions !
How do i prevent that from happening ?

HttpSession getSession(false);

 

[Arne Vajhøj]

I am writing set of REST services for some Flash clients, flash
doesn't send cookies and we don't want to user URL rewriting for most
of the services (they are just stateless).
The issue is when the client calls http://localhost/services/resource
say n times ... the application server/servlet container creates n
sessions !
How do i prevent that from happening ?

Servlets does not create sessions by default. JSP Pages
does, but I doubt that your REST service is a JSP page.

What REST framework are you using to create the service ?

(it should not create a session, because session is against
the core idea in REST)

Arne

 

[youssef.mohammed]

Servlets does not create sessions by default. JSP Pages
does, but I doubt that your REST service is a JSP page.

What REST framework are you using to create the service ?

I I have built few simple classes based on pure servlet. but i am
using spring framework as IoC container.

(it should not create a session, because session is against
the core idea in REST)

What if these services need to be authenticated. then we have do a
service to authenticate keep the user in the session, and get that
user everytime other authenticated service is invoked, right ?

 

[Arne Vajhøj]

I I have built few simple classes based on pure servlet. but i am
using spring framework as IoC container.

There are dedicated frameworks available like:
http://www.restlet.org/

What if these services need to be authenticated. then we have do a
service to authenticate keep the user in the session, and get that
user everytime other authenticated service is invoked, right ?

REST is intended to be stateless. A session means state.

The REST ways to do it are:
- BASIC or DIGEST authentication
- SSL client certificate
- custom HTTP header

Arne