This section describes the request process and how a Nucleus session name context is associated with that request.
When a request comes in without a session ID in the cookie or in the URL, the application server creates a new session for the requested web application.
The ATG
PageFilterdetermines if the session has been failed over and needs to be restored, or is a new session.If the request is for the parent web application, a session name context is created with the current session ID and added to the Nucleus component
/atg/dynamo/servlet/sessiontracking/GenericSessionManager.View that component in the Nucleus Component browser to see a list of current ATG session name contexts and the web applications that share those name contexts.
If the request is for a child web application, the parent application’s session ID is resolved in one of two ways, depending on the application server.
Some application servers maintain a single session ID between web applications for the same client (browser), in which case the session name context ID is the current web application’s session ID. This behavior is controlled by the
/atg/dynamo/property, which is set to one of the following default values in the
servlet/sessiontracking/GenericSessionManager.singleSessionIdPerUserDafEarsubmodule configuration layer:WebLogic –
falseJBoss –
trueWebSphere -
true
Note: Do not change these values from their defaults.
When the
singleSessionIdPerUservalue istrue, the application server uses the same session ID for all web applications, so lookup is not required. Note that the application server hands out the same session id, but not the same HttpSession object.When
singleSessionIdPerUserisfalse, a lookup determines the session name context ID. This is done by theatg.nucleus.servlet.SessionNameContextServlet servlet(included inatg_bootstrap.war), using aRequestDispatcher.include()call. TheSessionNameContextServletdoes two things:Sets the parent session ID as a request attribute that can then be used by the child web application to bind to the correct session context.
For application servers that don’t allow request attributes to be shared between web applications, it also sets a cookie named
ATG_SESSION_IDwith the session ID. This behavior is controlled by the/atg/dynamo/servlet/sessiontracking/GenericSessionManager.useSessionTrackingCookieproperty, which is pre-configured with the correct value for each application server.
The
atg.parent.session.idsession attribute is set to the parent session ID to avoid repeating the lookup.A new session-scoped context of type
atg.servlet.SessionNameContextnow exists under theGenericSessionManager. Because the ATG Nucleus components live outside the application server’s session, anatg.servlet.SessionBindingReporterobject is added to each web application session as an attribute. According to the J2EE spec, this object must be notified by the application server when the session is started (itsvalueBoundmethod invoked) or invalidated (itsvalueUnboundmethod invoked).The
SessionBindingReporterincrements a counter in theSessionNameContextit belongs to. This counter keeps track of the number of child web application session references to the Nucleus session scope. As each child is requested during the course of the browser session, this number increases.When the application server expires a session, either because of a user request (
session.invalidate()invoked) or due to a session timeout, it unbinds all the session attributes and invokes theatg.servlet.SessionBindingReporter.valueUnbound()method.The
valueUnbounddecrements theSessionNameContextcounter.When the counter reaches 0, all the child and parent web application sessions have been expired and it is safe for the ATG Nucleus session scope to be removed.
Note: Because the only link to the underlying session is through the SessionBindingReporter attribute, session management is a common cause for memory leaks. One such leak occurs on IBM WebSphere in a clustered environment, where the session invalidation can occur in a different JVM instance than where the session originated. See the Session Management in a WebSphere Cluster section.
