Session

A session is represented using an instance of the javax.servlet.http.HttpSession interface. A Tomcat session also implements the org.apache.catalina.Session interface.

The org.apache.catalina.session.StandardSession class is the standard implementation of the HttpSession interface within the Tomcat container.

Note the presence of the StandardSessionFacade which implements the same pattern that we have seen countless times before, of narrowing its subject's API to prevent a servlet programmer from accessing Tomcat's internals. It wraps a StandardSession instance and exposes the API defined by the HttpSession interface. All calls to it are delegated to the wrapped StandardSession instance.

As we noted in the last section, a session object is associated with a unique identifier and an attribute store that manages a binding of objects by name.

We will see more about the org.apache.catalina.Manager class later in the chapter. For now, note that it has a map of the Session instances that...