Augusto Sellhorn wrote:
> But when I use cookies and set the time to -1, they seems to go
> away when the browser exits.
>
You are talking here about cookies your application sets, right? You don't have
any direct access (in your servlet) to the cookie being used by the servlet
engine for session ID passing.
>
> Sessions seem to live even though the user exits the browser :(
> Could be a bug the servlet engine ? I'm just wondering what the
> supposed behaviour is.
>
Some servlet engines have a configuration parameter to set the life of a cookie
used for session ID maintenance. In most cases, the servlet engines I've used
default to "delete the cookie on exit", and that is what happens.
The supported behavior is that the session will remain in the server for some
amount of time after the user's last access (whether or not they have exited the
browser is not relevant). The minimum amount of time is the inactive interval
you have set. The maximum amount of time depends on your servlet engine
configuration.
>
> I'm using timeouts right now, and that's ok. But it would be even
> better if I could have timeouts and a little browser "hint" to say
> "Please if you can, when you exit, remove that cookie" :)
>
Timeouts (set via setMaxInactiveInterval or the servlet engine default) is all
you have to work with. When the user exits their browser, the server has no
clue that this has happened, so there is no way to do anything else.
If you are seeing cookies survive a client browser shutdown, and you have set
the age correctly, then you either have a broken browser or for some reason the
cookie you set the age on was not returned to the client correctly. An example
where that can happen is if you set the cookie after you have started generating
HTML output -- the HTTP headers (which include the cookies) have already been
sent, so your attempt to add a new cookie, or change an existing one, would be
ignored. To be safe, be sure you do anything you are going to with cookies
*before* you call getOutputStream() or getWriter().
Craig
___________________________________________________________________________
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff SERVLET-INTEREST".
Archives: http://archives.java.sun.com/archives/servlet-interest.html
Resources: http://java.sun.com/products/servlet/external-resources.html
LISTSERV Help: http://www.lsoft.com/manuals/user/user.html
