The concept of persisting a user session during the interaction with an application server has matured from maintaining hidden HTML fields and toying with URLs to a stable and robust technology under the J2EE framework. This is what is commonly referred to as an HTTP session - a conversation that spans multiple requests between a client and the server.

The session could be maintained at the various layers on the application architecture. It could reside on the client, on the presentation layer, in the object layer, or even in the database layer of the application. There are two options for maintaining client sessions when session data resides on the client layer. Session information can be maintained in hidden HTML fields or, alternatively, via the use of cookies, which are maintained on the client. This strategy has some inherent limitations, such as only String values can be stored and an increase in the size of session data increases the associated network overheads, which is a detriment to obtaining optimal performance. The lack of any persistence mechanism makes this approach vulnerable to client crashes.

Maintaining sessions on the presentation or the Web application layer is a better option from the perspective of performance, reliability, and usability. This strategy mitigates some of the earlier problems associated with client-side session management. It provides additional options to manage the session data, reduces network overheads, and imposes no constraints on the type and size of the objects that can be stored in the session. It also provides failover mechanisms for session state recovery in the case of server or cluster crashes. In addition, this approach utilizes various application server-specific features (clusters, for instance) that increase the reliability, scalability, and performance of the application.

Session data can also be maintained at the object layer by storing the data in stateful EJBs. This would utilize the Web application layer to store the handles of these stateful EJBs so clients can access the same bean to get the required information. This is a good approach when the application data is predominantly present in the object layer and the Web application layer is used primarily as an interface to the system. This combination results in a lightweight HTTP session and could potentially help improve the performance of the application. However, the overhead as a result of EJB activation and passivation need to be carefully considered.

WebLogic Server 7.0 provides a significant amount of flexibility and choice in determining the appropriate persistence mechanism for a wide variety of application needs. The session management is completely transparent to the user and can be easily configured via the deployment descriptor file of the Web application. This article focuses on the various HTTP session persistence mechanisms and their performance characteristics (in relative terms) for varying sizes of session data. There are five different implementations of session persistence: memory (single-server, nonreplicated), cookie-based, file system persistence, JDBC persistence and in-memory replication (across a cluster). These options, available in WebLogic Server 7.0, are in marked contrast to the competition, which only offers a JDBC persistence mechanism for clustered environments.

For the results shown here, a StringBuffer object is stored in the HTTP session and the size of the session data is varied by increasing the length of the StringBuffer object. The client measures the server response and calculates the throughput for 50 concurrent users. The graphs show the relative performance throughput for various sizes of session data size. In each case, the baseline number represents the throughput obtained when a StringBuffer object of unit length is stored in the session and the throughputs are computed relative to this baseline number.

Memory-Based Session Persistence
This is the default mechanism for managing sessions. The term "memory" refers to the server (JVM process) memory where the Web application is deployed and executed. The session data is maintained (in the JVM process memory) for the life cycle of the session object. To use the memory-based, single-server, nonreplicated persistent storage, set the PersistentStoreType property in the <session-descriptor> element of the WebLogic-specific deployment descriptor, weblogic.xml to memory. When you use memory-based storage, all session information is stored in memory and is therefore lost when you stop and restart WebLogic Server.

This approach provides very good performance but does not provide any failover capability (due to the lack of any data replication as mentioned above). Benchmark results (see Figure 1) indicate stable performance irrespective of the size of the session data.

Cookie-Based Session Persistence
This maintains the session state on the client, which is the biggest difference between this approach and the other mechanisms. There are two ways to set up cookie-based session persistence: set the PersistentStoreType property in the <session-descriptor> element of weblogic.xml to cookie; or, optionally, set a name for the cookie using the PersistentStoreCookieName parameter. The default is WLCOOKIE.

This approach is most useful when you don't need to store large amounts of data in the session and it doesn't require the use of WebLogic clusters. Since the session is stored on the client (and not on the server), you can start and stop WebLogic Servers without losing sessions. The major limitation of cookie-based persistence is that only string attributes can be stored in the session.

File-Based Session Persistence
This is a cost-effective solution, as it relies on the underlying file system to persist data and thus eliminates the need for a database. To configure file-based persistent storage for sessions, set the PersistentStoreType property in the <session-descriptor> element of weblogic.xml to file and specify the directory where WebLogic Server stores the sessions (defined by the PersistentStoreDir attribute in weblogic.xml). WebLogic Server creates various subdirectories under this directory to store session data in the form of files. The creation of this root directory and all other subdirectories and files used to maintain session information is automatically taken care of by the WebLogic Server and these files are generated, updated, and deleted based on the session life-cycle events. The failover mechanism offered under this approach depends upon how the root directory has been defined. This could be set to the name of a directory or a common directory on the local machine, or it could be a shared directory on the network. Making the root directory a shared directory among the different servers in a cluster makes file-persistent sessions resilient to failures.

It is important to ensure that you have enough disk space to store the number of valid sessions multiplied by the size of each session. The size of a session can be determined by looking at the files created under the root directory. (Note that the size of each session can vary as the size of serialized session data changes.) From a performance perspective, file persistence is the slowest mechanism for managing sessions.

JDBC-Based Session Persistence
This configuration doesn't require the use of WebLogic clusters and gives users the option of maintaining the session state for longer periods of time (as the session information is persisted in a database). To configure JDBC-based persistent storage for sessions, set the PersistentStoreType property in the <session-descriptor> element of weblogic.xml to jdbc and specify a JDBC connection pool to be used for persistence storage with the PersistentStorePool property (additional required configuration steps are described in the references at the end of this article).

The use of a database also offers the most reliable solution for data persistence and failover in the event of server crash. Since session data is stored in a database, any server can access the session through use of a session identifier that serves as the client's session identity in the database.

The choice of the database, JDBC driver, and JDBC connection pool configuration affects the overall performance of this approach. While all session persistence mechanisms have to deal with the overheads of data serialization and deserialization, the additional overhead of the database interaction impacts the performance of the JDBC-based session persistence and causes it to under-perform compared with the in-memory replication (see Figures 4, 5, and 6). JDBC-based session persistence caters more toward those applications that require long-term persistent storage of session data and is ideal for situations where failover and data-persistence requirements take preference over performance.

In-Memory-Based Session Persistence
In contrast to the previously described persistence mechanisms, in-memory-based session persistence requires the use of WebLogic clustering and offers the best overall choice in terms of performance and other tradeoffs that may be required in a typical real-world situation. To configure in-memory session persistence, set the PersistentStoreType property in the <session-descriptor> element of weblogic.xml to replicated. In-memory replication is achieved by maintaining a replicated session or in-memory replica of the session state on the the secondary server in a clustered configuration. By default, WebLogic Server attempts to create session state replicas on a different machine than the one that hosts the primary session state. You can further control (via the WebLogic Server console, for instance) where the secondary states are placed using replication groups. A replication group is a preferred list of clustered servers to be used for storing session state replicas.

The primary server handles the user's requests while the WebLogic replication manager creates a secondary server for this user session and maintains a copy of the session object. The replication manager handles all the details of replicating the session data to the remote secondary and keeps this copy in sync with the primary server's session object.

The following Web server and proxy software support in-memory replication for HTTP sessions:

• Figure 1
• Figure 2
• Figure 3
• Figure 4
• Figure 5
• Figure 6