Tomcat 是怎样管理Session的方法示例

public class StandardSessionFacade implements HttpSession 

 private final HttpSession session;
 public StandardSessionFacade(HttpSession session) {
 this.session = session;
 }

 @GetMapping("/s")
 public String sessionTest(HttpSession httpSession) throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
 StandardSessionFacade session = (StandardSessionFacade) httpSession;
 Class targetClass = Class.forName(session.getClass().getName());

 //修改可见性
 Field standardSessionField = targetClass.getDeclaredField("session");
 standardSessionField.setAccessible(true);
 //获取
 StandardSession standardSession = (StandardSession) standardSessionField.get(session);
 
 return standardSession.getManager().toString();
 }

public class StandardSession implements 
HttpSession, Session, Serializable

 @GetMapping("/s")
 public void sessionTest(HttpSession httpSession, HttpServletResponse response) throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException, IOException {
 StandardSessionFacade session = (StandardSessionFacade) httpSession;
 Class targetClass = Class.forName(session.getClass().getName());

 //修改可见性
 Field standardSessionField = targetClass.getDeclaredField("session");
 standardSessionField.setAccessible(true);
 //获取
 StandardSession standardSession = (StandardSession) standardSessionField.get(session);
 
 //存点数据以便观察
 standardSession.setAttribute("msg","hello,world");
 standardSession.setAttribute("user","kesan");
 standardSession.setAttribute("password", "点赞");
 standardSession.setAttribute("tel", 10086L);
 //将序列化的结果直接写到Http的响应中
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(response.getOutputStream());
 
 standardSession.writeObjectData(objectOutputStream);
 }

 public void setAttribute(String name, Object value, boolean notify) {
 //省略无关代码
  //获取上文中配置的事件监听器
 Object listeners[] = context.getApplicationEventListeners();
 if (listeners == null) {
  return;
 }
 for (int i = 0; i < listeners.length; i++) {
  //只有HttpSessionAttributeListener才可以执行
  if (!(listeners[i] instanceof HttpSessionAttributeListener)) {
  continue;
  }
  HttpSessionAttributeListener listener = (HttpSessionAttributeListener) listeners[i];
  try {
  //在当前线程调用监听器的处理方法
  if (unbound != null) {
   if (unbound != value || manager.getNotifyAttributeListenerOnUnchangedValue()) {
   //如果是某个键的值被修改则调用监听器的attributeReplaced方法
   context.fireContainerEvent("beforeSessionAttributeReplaced", listener);
   if (event == null) {
    event = new HttpSessionBindingEvent(getSession(), name, unbound);
   }
   listener.attributeReplaced(event);
   context.fireContainerEvent("afterSessionAttributeReplaced", listener);
   }
  } else {
   //如果是新添加某个键则执行attributeAdded方法
   context.fireContainerEvent("beforeSessionAttributeAdded", listener);
   if (event == null) {
   event = new HttpSessionBindingEvent(getSession(), name, value);
   }
   listener.attributeAdded(event);
   context.fireContainerEvent("afterSessionAttributeAdded", listener);
  }
  } catch (Throwable t) {
  //异常处理
  }
 }
 }

 public StandardSession(Manager manager) {
 //调用Object类的构造方法,默认已经调用了
 //此处再声明一次，不知其用意，或许之前此类有父类?
 super();
 
 this.manager = manager;
 //是否开启访问计数
 if (ACTIVITY_CHECK) {
  accessCount = new AtomicInteger();
 }
 }

protected Map<String, Session> sessions = new ConcurrentHashMap<>();

 public Session createSession(String sessionId) {
 //检查Session是否超过限制,如果是则抛出异常
 if ((maxActiveSessions >= 0) &&
  (getActiveSessions() >= maxActiveSessions)) {
  rejectedSessions++;
  throw new TooManyActiveSessionsException(
   sm.getString("managerBase.createSession.ise"),
   maxActiveSessions);
 }

 //该方法会创建StandardSession对象
 Session session = createEmptySession();

 //初始化Session中必要的属性
 session.setNew(true);
 //session是否可用
 session.setValid(true);
 //创建时间
 session.setCreationTime(System.currentTimeMillis());
 //设置session最大超时时间
 session.setMaxInactiveInterval(getContext().getSessionTimeout() * 60);
 String id = sessionId;
 if (id == null) {
  id = generateSessionId();
 }
 session.setId(id);
 sessionCounter++;
 //记录创建session的时间，用于统计数据session的创建速率
 //类似的还有ExpireRate即Session的过期速率
 //由于可能会有其他线程对sessionCreationTiming操作因此需要加锁
 SessionTiming timing = new SessionTiming(session.getCreationTime(), 0);
 synchronized (sessionCreationTiming) {
  //sessionCreationTiming是LinkedList
  //因此poll会移除链表头的数据，也就是最旧的数据
  sessionCreationTiming.add(timing);
  sessionCreationTiming.poll();
 }
 return session;
 }

 @Override
 public void remove(Session session, boolean update) {
 //检查是否需要将统计过期的session的信息
 if (update) {
  long timeNow = System.currentTimeMillis();
  int timeAlive =
  (int) (timeNow - session.getCreationTimeInternal())/1000;
  updateSessionMaxAliveTime(timeAlive);
  expiredSessions.incrementAndGet();
  SessionTiming timing = new SessionTiming(timeNow, timeAlive);
  synchronized (sessionExpirationTiming) {
  sessionExpirationTiming.add(timing);
  sessionExpirationTiming.poll();
  }
 }
 //将session从Map中移除
 if (session.getIdInternal() != null) {
  sessions.remove(session.getIdInternal());
 }
 }

 public void invalidate() {

 if (!isValidInternal())
  throw new IllegalStateException
  (sm.getString("standardSession.invalidate.ise"));

 // Cause this session to expire
 expire();
 }

 @Override
 public void expire() {

 expire(true);

 }
 public void expire(boolean notify) {
  //省略代码
  //将session从ConcurrentHashMap中移除
  manager.remove(this, true);
  //被省略的代码主要是将session被销毁的消息通知
  //到各个监听器上
 }

 @Override
 public void backgroundProcess() {
 count = (count + 1) % processExpiresFrequency;
 if (count == 0)
  processExpires();
 }

 public void processExpires() {

 long timeNow = System.currentTimeMillis();
 Session sessions[] = findSessions();
 int expireHere = 0 ;

 if(log.isDebugEnabled())
  log.debug("Start expire sessions " + getName() + " at " + timeNow + " sessioncount " + sessions.length);
 //从JConsole的图中可以看出isValid可能导致expire方法被调用
 for (int i = 0; i < sessions.length; i++) {
  if (sessions[i]!=null && !sessions[i].isValid()) {
  expireHere++;
  }
 }
 long timeEnd = System.currentTimeMillis();
 if(log.isDebugEnabled())
  log.debug("End expire sessions " + getName() + " processingTime " + (timeEnd - timeNow) + " expired sessions: " + expireHere);
 processingTime += ( timeEnd - timeNow );

 }

 /**
 * This method will be invoked by the context/container on a periodic
 * basis and allows the manager to implement
 * a method that executes periodic tasks, such as expiring sessions etc.
 */
 public void backgroundProcess();

//bad
httpSession.setAttribute("user","kesan");
httpSession.setAttribute("nickname","点赞");
httpSession.setAttribute("sex","男");
....

//good
User kesan = userDao.getUser()
httpSession.setAttribute("user", kesan);