SPRING CONCEPTS
HttpSession / session scope
Spring Concepts / HttpSession / session scope
HttpSession stores server-side attributes associated with a visitor’s session.
Understand the idea
Tomcat normally uses a JSESSIONID cookie to find the session. Attributes survive related requests until timeout or invalidation. Two tabs in one browser profile generally share cookies and the session; another profile has its own session.
A concrete example
request.getSession().setAttribute("flash", "Saved");
request.getSession().invalidate();In the application
Manual 00 stores the todoStore, visit counter, flash message, and CSRF token in the session.
A session is not a login account or a durable database. Browser closing and server restarts are not reliable substitutes for explicit invalidation.