Programmatically simulate user activity on server side to prolongate the HttpSession

Hi,

I have a tomcat server which allows to upload rather big files in the secured area. I am using apache commons fileupload, so the upload is performing in background on server.

Now, when I login, press "upload" for big file, go away for some time, then return and see the login request page instead of upload success page (I have a script which forwards to another page of the site when upload is finished, but it seems that upload itself fails too) - the session timed out while the file had been uploading. If I make some activity on the site during upload (navigate among pages), the upload would finish fine.

So, what I want to do is to try to keep HttpSession alive programmatically on server side while the file is being uploaded - I have upload progress listener, so it could call something like session.resetTimer() - same thing which is called when the user request some page. But I can't see anything looking like this method in HttpSession class - only session.invalidate() method which is opposite to what I want.

Is there a way to simulate user activity on server side to prolongate the session?

thank's

ok, it seems that I have found something, but still can't use it. The method I was thinking of is org.apache.catalina.Session.access();

http://tomcat.apache.org/tomcat-5.5-doc/catalina/docs/api/org/apache/catalina/session/StandardSession.html#access%28%29

Tomcat's HttpSession implementation is StandardSession object, which also implements org.apache.catalina.Session interface which has the "access" method.

So, I have tried to call in this way (after adding lib/catalina.jar to project's classpath)
((org.apache.catalina.Session) request.getSession()).access();

this did not work, cause tomcat did not want to deploy web application with catalina.jar as local dependency.

So, I tried reflection (after removing catalina.jar from deps):

request.getSession().getClass().getMethod("access").invoke(request.getSession());

But this did not work either, cause though debugger shows request.session attribute of type StandardSession (which has the "access" method I need), the request.getSession() call returns StandardSessionFacade (http://tomcat.apache.org/tomcat-5.5-doc/catalina/docs/api/org/apache/catalina/session/StandardSessionFacade.html) wrapped around this object, which does not provide access to "access" method of the wrapped session.

So it seems that the call I need is hidden rather well.

What is wrong with using the javax.servlet.http.HttpSession method setMaxInactiveInterval

That would appear to be the tool the API provides for "prolongate"ing session life.

Bill

My server allows to upload rather big files - it may take up to several hours for upload to finish depending on the connection speed, I can't predict how long it will take. So for sure, I can try to set infinite (ok, 24 hours is enough) session life - seems that I will finally come to this solution, but actually I need such long sessions only for file upload process, so this seems to be rough solution and ineffective in long term.

For the setMaxInactiveInterval - I have checked its source code - it would set only inactive interval value, but will not reset the timer. Still, this might be better, than setting value in servlet context and probably would work as workaround - make the session 24 hours when upload is started and return default value when it is finished, I will try how this would go, thank's.

anton moiseev wrote:So, I tried reflection (after removing catalina.jar from deps):

request.getSession().getClass().getMethod("access").invoke(request.getSession());

But this did not work either, cause though debugger shows request.session attribute of type StandardSession (which has the "access" method I need), the request.getSession() call returns StandardSessionFacade (http://tomcat.apache.org/tomcat-5.5-doc/catalina/docs/api/org/apache/catalina/session/StandardSessionFacade.html) wrapped around this object, which does not provide access to "access" method of the wrapped session.

So it seems that the call I need is hidden rather well.

I stumbled upon this thread looking for the same thing. The reason I want to simulate activity is to compensate for activity on another linked system that is using the tomcat session ID as an authorization key without pounding the primary system with 'ping' requests.

I was able to accomplish this by first using reflection to extract the StandardSession from the facade and then calling the access() method via the reflection you described. I tested with Tomcat 5.5.33, browsing the source it appears it should work well with Tomcat 6 and 7 also. Here is the code

import java.lang.reflect.Field; import javax.servlet.http.HttpSession; public class TouchSession { /** * This will 'touch' the session to keep it from expiring. * It has only been tested on Tomcat 5.5.33. * It may work on other versions of Tomcat but is unlikely to work on * Servlet implementations other than Tomcat. * * @param session actually an instance of Tomcat StandardSessionFacade */ public static void access(HttpSession session) { try { //System.out.println("before="+session.getLastAccessedTime()); Field f = session.getClass().getDeclaredField("session"); f.setAccessible(true); HttpSession realSess = (HttpSession) f.get(session); realSess.getClass().getMethod("access").invoke(realSess); //System.out.println("after="+session.getLastAccessedTime()); } catch (Exception e) { e.printStackTrace(); } } }