Web Application Session Data

• When developing new objects to be stored in the HTTP session, they should implement Serializable to ensure that they can be persisted into a database or send via the message server if clustered sessions are enabled by the system administrator.
• Maximize use of session affinity and avoid breaking affinity. Session affinity is enabled by default in WebSphere Application Server. It ensures that, except for hardware or software fail-over, requests are handled by the container which initialized that session. Session clustering may be used in addition to affinity to handle fail-over.
• Release HttpSessions when done, call HttpSession.invalidate(). Otherwise the session objects remain in memory until the session timeout expires.
• It does not make sense to protect access to session state only part of the time.
• Distributed HttpSession support does not guarantee transactional integrity of an attribute in a failover scenario or when session affinity is broken.