URL Re-writing in Session Handling

URL Re-writing is a technique by which session data can be handled within the server side only.Client is not responsible for keeping any information regarding session. In this process at every request the required session data is appended to the URL path to make the next request. All session information is retrieved by the web Server as a request parameter.

There is a way by which session data get appended to the URL path is by
1. Using Query String

Using Query String
A Complete URI is the combination of context path + Servlet path + path info . Query String is appended after Requested URI with the " ? " symbol containing name and value pair.

For example :

http://localhost:9999/myApp/loginServlet?name=xyz&pass=123&.........

In the above example is a complete URL under this,

localhost      ->  Server name
9999           ->  Port Number
/myApp       ->  Context path
/loginServlet ->  Servlet path
jsessionid="" -> Query String.

Value of jsessionid can be retrieved in the servlet  using the getParameter(String) method with the HTTP request object.

Note: Session ID is appended to the URI using the HTTP GET method request type, which allows to send small data with the request in the form of Query String and hence restricted to maximum 255 character. So with Query we are appending client's session information with every request to maintain the clients activity with each proceeding request.

This is how all the session data can be passed to a servlet/jsp with the URL using GET request type from a jsp page.

If we want to transfer the session data from a servlet to another using URL rewriting then we have to use hyperlink and append the same in the url using the " ? " symbol and can able to get the value using the getParameter(String) .

Advantage of URL Rewriting 

1. Doesn't depend on client to store client's session information.

Disadvantages of URL Rewriting

1. Every we need to pass the value as a query string produces heavy loads to the traffic.

2. Through GET method type maximum 255 characters are allowed to pass, it would not be possible it passing parameters exceeds 255 characters.

3. Visible with very request with the request URL. So it may cause security issue and hence not secure.

4. It works only when every page is dynamically generated that means cannot be possible with the html.

5. Passing jsessionid as a Query String needs some Javascript code to submit the form, otherwise it is not possible with the general form submission.

6. It is only possible with GET method type and hence cannot with POST method type.

7. very difficult to maintain the required session data with each proceeding request by the client.