Java HttpSession 属性存储在哪里？
对象是否被序列化并发送给用户并在每个连接上返回（存储在 cookie 中）？
或者它们存储在服务器堆中并且cookie只是一个非常小的标识符？
有关此主题的任何信息都会有所帮助。
谢谢
Are the objects serialized and sent to the user and back on each connection (stored in cookies) ?
Or are they stored in the server heap and the cookie is only a very small identifier ?
Any information about this topic would be helpful.
Thank you
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
你第二次猜到了。
该 cookie 包含一个 JSESSIONID。该 id 用于在服务器维护的映射中查找用户的 HttpSession。至少这是最常见的方式。服务器可以通过更复杂的方式来实现这一点，但在 cookie 中来回穿梭整个状态并不是其中之一。
这有一些影响。首先，如果服务器出现故障，您就会丢失会话状态。其次，如果您有服务器集群，则需要让用户每次都连接到同一台服务器，否则他们将在后续请求之间丢失会话。最后，如果有人找到复制别人的 JSESSIONID 并用它替换自己的方法，会话劫持就成为可能。
You got it on the second guess.
The cookie contains a JSESSIONID. That id is used to look up the user's HttpSession in a map that the server maintains. At least this is the most common way. There are more intricate ways that the server can implement this, but shuttling the entire state back an forth in a cookie isn't one of them.
This has some implications. First, if the server goes down, you lose session state. Second, if you have a server cluster, you need to get the user connected to the same server each time, or they will lose their session between subsequent requests. Lastly, session hijacking becomes a possibility if someone finds a way to copy someone else's JSESSIONID and replace theirs with it.
cookie 仅包含会话标识符（通常称为 JSESSIONID ）。服务器将此标识符映射到当前存储在用户会话中的任何数据。
数据本身可以存储在内存中，也可以序列化到数据库或文件，具体取决于您使用的服务器及其配置。
The cookie just contains a session identifier (typically called
JSESSIONID). The server maps this identifier to whatever data is currently stored in the user's session.The data itself may be stored in memory, or it may be serialized to database or to file depending upon what server you are using and its configuration.