会话对象会占用应用资源吗？为何需手动清理而非依赖垃圾回收？

Great question—let’s break this down to clear up your confusion, because it’s a super common point of mix-up when first learning about servlet sessions.

First: Your Core Misunderstanding #

You’re right that the HttpSession s variable in your servlet thread is scoped to that thread and gets cleaned up when the thread finishes. But here’s the key mistake: that variable is just a reference to the actual session object stored on the server. The servlet container (like Tomcat, Jetty, etc.) maintains its own global collection (managed by a Session Manager) that holds strong references to all active session objects.

So even when your servlet thread dies and the s reference is gone, the container’s Session Manager still has a live reference to the session object in the heap. That means the garbage collector can’t touch it—GC only collects objects with no active strong references.

Is the Session Object Stored in the Heap? #

Yes, absolutely. By default, all session objects (and their attributes) live in the JVM’s heap memory. Some containers let you configure off-heap storage or persistent sessions (like storing in a database), but the standard in-memory session resides in the heap.

Why Manual Session Cleanup Matters #

Now, why does the book talk about invalidate() and setMaxInactiveInterval() if GC doesn’t handle this? Let’s cover the two main reasons:

1. Immediate Cleanup for User Actions #

When a user explicitly logs out (clicks a "Sign Out" button), you don’t want their session hanging around in memory until it times out. Calling session.invalidate() tells the container to remove its reference to the session object immediately. This frees up heap memory right away and ensures the session can’t be reused accidentally (a nice security win too).

2. Preventing Memory Bloat from Stale Sessions #

Without setting a timeout (setMaxInactiveInterval()), the container would never automatically remove sessions that users abandoned (e.g., closed their browser without logging out). Over time, these stale sessions would accumulate in the heap, eating up memory and potentially leading to OutOfMemoryErrors in high-traffic apps. The timeout lets the container automatically clean up sessions that haven’t had any activity for a specified period.

A Quick Recap #

• Your servlet thread’s HttpSession variable is just a local reference—the container holds the critical reference that keeps the session alive.
• GC can only collect the session object once the container removes its reference (either via invalidate() or timeout).
• Manual cleanup is about being proactive: freeing resources immediately when needed, and preventing memory leaks from abandoned sessions.

内容的提问来源于stack exchange，提问作者Stefan