Tomcat每次创建新HTTPRequest时，如何在多请求中维护同一Session对象？

Great question—this is a core part of how session management works in Tomcat, and it all boils down to tracking a unique session identifier across requests. Let me break down the process step by step:

• Step 1: Session ID Creation on First Request
  When a user sends their first request to a Tomcat-hosted servlet, Tomcat spins up a new HttpSession object and generates a unique, cryptographically random JSESSIONID (this is the session's unique identifier). It immediately attaches this new session to the current HttpRequest, so your servlet can access it via request.getSession().

• Step 2: Sending the Session ID to the Browser
  Tomcat sends this JSESSIONID back to the user's browser using one of two standard methods:

  1. HTTP Cookie (Default): Tomcat sets a cookie named JSESSIONID with the session ID value. The browser stores this cookie and automatically includes it in every subsequent request to the same domain.
  2. URL Rewriting (Fallback): If the browser has cookies disabled, Tomcat can rewrite URLs to append the session ID (e.g., http://yourapp.com/home;jsessionid=XYZ789...). This ensures session tracking still works, though it’s less common in modern apps.

• Step 3: Linking Subsequent Requests to the Existing Session
  For every new HttpRequest that comes into Tomcat:

  1. Tomcat first extracts the JSESSIONID—either from the request’s cookies or from the rewritten URL.
  2. It checks its internal session store (usually in-memory via StandardManager, but configurable for persistent storage like databases) for a HttpSession object that matches this ID.
  3. If a valid, non-expired session is found, Tomcat attaches that existing session to the new HttpRequest object. If no match exists (e.g., the session timed out or the ID is invalid), it creates a brand new session and corresponding JSESSIONID.

• Behind the Scenes: The Session Manager
  Tomcat’s Manager component is the workhorse here. It handles storing active sessions, managing session expiration (cleaning up old sessions automatically), and ensuring that each incoming request gets linked to the correct session using the JSESSIONID as the key.

The key takeaway: The HttpRequest object is just a temporary container for the current request’s data, including a reference to the session. The actual HttpSession lives independently in Tomcat’s session store, so even though every request gets a new HttpRequest, they can all point to the same underlying session as long as they provide the right JSESSIONID.

内容的提问来源于stack exchange，提问作者Delphi