public class HttpSession extends Object implements ClientCommunicationInterface
| Modifier and Type | Field and Description |
|---|---|
ClientSession | clientSessionThe client session that this HTTP session is tied to (null if none). |
HttpUserEnvironment | environmentThe user environment. |
int | errCodeThe current error code (zero if none yet, or 200 if OK). |
String | errExtraThe current extra error text (empty string if none yet). |
String | errTextThe current error text (empty string if none yet). |
Hashtable<String,String> | formDataThe table of decoded form data in name/value pairs (or null if no posted data). |
String | fullServerNameThe protocol, name and port of this server (http[s]://hostName[:port]. |
HttpHeaderFields | headerFieldsThe header fields. |
static String | hexesHex characters. |
String | hostAddressThe address of this server. |
String | hostNameThe name of this server. |
String | httpMethodThe HTTP method used (GET, POST or n/a). |
String | httpVersionThe http protocol version. |
boolean | isKeepAliveIndicates that this connection is of keep-alive state. |
boolean | isReplyDataCgiGeneratedBoolean value that is set to true if the reply data is CGI-generated. |
HttpSession | previousHttpSessionThe previous HTTP session (saved for the state-less communication). |
String | replyContentTypeReply Content-type (null is default). |
String | requestLineThe request line. |
HttpRequestParser | requestParserThe current request parser. |
HttpResource | resourceThe current HTTP resource to be sent or that has been sent to the client (null if none). |
String | resourceNameThe requested resource name. |
int | serverPortThe server port number. |
ServerSocketInterface | serverSocketThe server socket interface (null if none). |
Date | sessionEstablishedTimeTime when the session was first established. |
ISocket | socketThe current socket (null if none). |
String | uriParamsThe URI parameters (after '?', may be null if not specified). |
AdminConfigWebApplication | webApplicationThe web application data. |
HttpWebServer | webServerThe Web Server. |
| Constructor and Description |
|---|
HttpSession(HttpWebServer webServer)Creates a new .... |
| Modifier and Type | Method and Description |
|---|---|
void | addReplyExtraHeader(String header)Add reply extra header (from CGI). |
boolean | close()Closes an open client connection. |
void | createConstAppAction()Create constant AppAction session ID. |
void | createSessionCookie(HttpSession httpSetSession)Creates and sets a cookie identification string to be used for this session and for further checks when new GET or POST data is sent from a client. |
void | createSingleSessionCookie(boolean doRemove)Creates (or removes) a single-session special cookie. |
boolean | dispose()The session is disposed of. |
boolean | doesCookieSessionMatch()Verifies that the current session originates from a previously created cookie session identification string. |
String | getApplicationAction()Get application action = server name + resource name + current digest code. |
BrowserCapabilities | getBrowserCapabilities()Gets the browser capabilities. |
String | getClientDNSName()Gets the DNS name of this client connection. |
InetAddress | getClientInetAddress()Gets the address of the client or null if socket is not connected. |
String | getClientIPAddress()Gets the IP address of this client connection (as 1.2.3.4). |
String | getConstAppAction()Access the constant AppAction session ID. |
VirtualInterface | getControl(String id)Gets a virtual "control" from an ID (can also be a menu item). |
int | getControlMaximumLength(String id)Gets the control ID maximum length. |
String | getControlText(String id)Gets the control ID text. |
String | getControlText(String id, int col, int row)Gets the control ID text. |
String | getCurrentSequencedDigestCode()Gets the session identifier digest code of the current sequence ID. |
String | getDigestCode()Gets the session identifier digest code. |
String | getGlobalVariable(String name)Gets a NetPhantom global variable. |
static char | getHex(int v)Gets the hex representation of a number 0-15. |
String | getHostField(String name)Gets the host field by name. |
String | getHostField(String name, int line)Gets the host field by name. |
static long | getLongRandom()Gets a random long value. |
HttpSession | getMessageDigestSession()Gets the session used for message digests. |
String | getMultipartCharset()The character set used to decode a multipart request body that names none itself. |
String | getNextSequencedDigestCode()Gets the session identifier digest code of the next sequence ID. |
byte[] | getRawFormData()The request body exactly as it arrived, undecoded. |
String | getReplyCharset()The character set this reply is encoded in. |
Enumeration<String> | getReplyExtraHeaders()Get reply extra headers (or null if none). |
String | getSecureLoginCookie(String resourceName)Checks if there is a SecureLogin cookie set for this session. |
String | getSequenceID()Access current sequence number (ID). |
InetAddress | getServerInetAddress()Gets the address of the server or null if no connection exists. |
ServerSocketInterface | getServerSocket()Gets the server socket interface associated with the accept of this socket. |
static HttpSession | getSession(String hashCode, boolean checkDigestCode)Looks up an existing httpSession from a hash code. |
String | getSessionCookieID()Get cookie session ID. |
boolean | getSetCookies(StringBuilder buf)Gets the cookies set to send to the client for this session (if any). |
HttpSession | getSingleSessionForUser()Gets the single-session cookie (if this is allowed). |
ISocket | getSocket()Gets socket associated with this communication. |
String | getTextID(String id)Gets a text ID from the current runtime application. |
String | getTranslatedHostField(String name)Gets the host field by name after it has undergone translation using the application translation table. |
String | getTranslatedHostField(String name, int line)Gets the host field by name after it has undergone translation using the application translation table. |
HashMap<String,String> | getURIParams()Gets the URI parameters without regards to case. |
HashMap<String,String> | getURIParams(boolean keepCase)Gets the URI parameters without regards to case. |
static HashMap<String,String> | getURIParams(String uriParams, boolean keepCase)Parses the URI params. |
String | getVisibleControlText(String id, int col, int row)Gets the control ID text. |
void | hardClose()Hard-closes the current socket connection to the client. |
boolean | hasSessionTimedOut()Checks if a session has been inactive for a certain amount of time. |
boolean | isCookieUsed()Check if cookie is used. |
boolean | isHTTP10()Checks if this HTTP session is of version 1.0 or lower. |
boolean | isHTTP11()Checks if this HTTP session is of version 1.1 or higher. |
static String | md5Digest(MessageDigest md, String string)MD5-Digests a String to a hex code. |
String | md5Digest(String string)MD5-Digests a String to a hex code. |
byte[] | receiveTransaction()Reads a transaction from the client. |
byte[] | receiveTransaction(Object[] isCompressed)Reads a transaction from the client. |
void | removeSessionCookie()Remove session cookie. |
void | saveSession()Saves this session to be used for state-less HTTP communication. |
void | sendTransaction(byte[] data)Sends a transaction to the client. |
void | sendTransaction(byte[] data, int type)Sends a transaction to the client. |
void | setCookie(HttpCookie cookie)Sets a cookie to send to the client. |
void | setMultipartCharset(String charset)Decodes multipart request bodies in a character set other than the historical default. |
void | setRawFormData(byte[] data)Records the request body as it arrived. |
void | setReplyCharset(String charset)Encodes this reply in a character set other than the web server's configured default. |
void | setSecureLoginCookie(String value, String resourceName)Sets the SecureLogin cookie value for this session to a string. |
void | transferSession(HttpSession newSession)Transfers control of a NetPhantom Application from the session specified as a parameter to an existing one. |
void | varDelete(String name)Deletes a HTTP session variable. |
void | varDeleteAll()Deletes all variables. |
String | varGet(String name)Gets the contents of a HTTP session variable. |
void | varSet(String name, String data)Sets a HTTP session variable. |
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitisUsingWebSocketpublic static final String hexes
public boolean isReplyDataCgiGenerated
public boolean isKeepAlive
public String replyContentType
public final HttpWebServer webServer
public HttpUserEnvironment environment
public ISocket socket
public ServerSocketInterface serverSocket
public String hostName
public String hostAddress
public int serverPort
public String fullServerName
public String httpVersion
public String requestLine
public String httpMethod
public String uriParams
public String resourceName
public HttpHeaderFields headerFields
public final Date sessionEstablishedTime
public int errCode
public String errText
public String errExtra
public Hashtable<String,String> formData
public ClientSession clientSession
public HttpSession previousHttpSession
public HttpResource resource
public AdminConfigWebApplication webApplication
public HttpRequestParser requestParser
public HttpSession(HttpWebServer webServer)
public void setRawFormData(byte[] data)
Called from exactly one place in the request parser, before either decoder runs. Do not add a second caller: formData is written by two branches and that is the shape of the defect this exists to avoid repeating.
Cloned on the way in, so a buffer the parser reuses cannot change underneath a session that is still holding it.
data - The body bytes, or null for none.public byte[] getRawFormData()
Cloned on the way out, so a CGI cannot mutate the session's copy – and so two CGIs reading it cannot interfere with one another.
public void setCookie(HttpCookie cookie)
public boolean getSetCookies(StringBuilder buf)
public boolean isHTTP10()
public boolean isHTTP11()
public void varSet(String name, String data)
public String varGet(String name)
public void varDelete(String name)
public void varDeleteAll()
public String getHostField(String name)
public String getHostField(String name, int line)
public String getTranslatedHostField(String name)
public String getTranslatedHostField(String name, int line)
public String getTextID(String id)
public int getControlMaximumLength(String id)
public String getControlText(String id)
public String getControlText(String id, int col, int row)
The following combination of parameters apply:
Parameter Normal control Combobox List box --------------- -------------- ------------ ------------------ x and y omitted text text n/a x omitted n/a line in list n/a y omitted n/a n/a Header column text both x,y n/a n/a List box cellNote that the text for the control is returned even if it is not visible.
public String getVisibleControlText(String id, int col, int row)
The following combination of parameters apply:
Parameter Normal control Combobox List box --------------- -------------- ------------ ------------------ x and y omitted text text n/a x omitted n/a line in list n/a y omitted n/a n/a Header column text both x,y n/a n/a List box cellNote that the text for the control is empty if the control is not visible.
public VirtualInterface getControl(String id)
public String getGlobalVariable(String name)
public String getClientDNSName()
getClientDNSName in interface SocketNameInterfacepublic String getClientIPAddress()
getClientIPAddress in interface SocketNameInterfacepublic String getDigestCode()
public String getCurrentSequencedDigestCode()
public String getNextSequencedDigestCode()
public String getSequenceID()
public static String md5Digest(MessageDigest md, String string)
public static char getHex(int v)
public boolean isCookieUsed()
public void createSessionCookie(HttpSession httpSetSession)
Note: if the web application is not using cookies, this method will do nothing.
public void createSingleSessionCookie(boolean doRemove)
public HttpSession getSingleSessionForUser()
public String getSessionCookieID()
public boolean doesCookieSessionMatch()
public void removeSessionCookie()
public String getSecureLoginCookie(String resourceName)
public void setSecureLoginCookie(String value, String resourceName)
public BrowserCapabilities getBrowserCapabilities()
public void saveSession()
public String getApplicationAction()
public void createConstAppAction()
public String getConstAppAction()
public static HttpSession getSession(String hashCode, boolean checkDigestCode)
public void transferSession(HttpSession newSession)
public HttpSession getMessageDigestSession()
public boolean dispose()
public boolean hasSessionTimedOut()
public InetAddress getClientInetAddress()
getClientInetAddress in interface ClientCommunicationInterfacepublic InetAddress getServerInetAddress()
getServerInetAddress in interface ClientCommunicationInterfacepublic byte[] receiveTransaction()
receiveTransaction in interface ClientCommunicationInterfacepublic byte[] receiveTransaction(Object[] isCompressed)
receiveTransaction in interface ClientCommunicationInterfacepublic void sendTransaction(byte[] data)
sendTransaction in interface ClientCommunicationInterfacepublic void sendTransaction(byte[] data,
int type)sendTransaction in interface ClientCommunicationInterfacepublic boolean close()
close in interface ClientCommunicationInterfacepublic void hardClose()
hardClose in interface ClientCommunicationInterfacepublic ISocket getSocket()
getSocket in interface ClientCommunicationInterfacepublic ServerSocketInterface getServerSocket()
getServerSocket in interface ClientCommunicationInterfacepublic void addReplyExtraHeader(String header)
The hazard here is a LOST UPDATE, not merely stale visibility. An HttpSession outlives the connection that created it – instances live in the static sessions map, are found again by getSession(String,boolean), and transferSession(HttpSession) deliberately rebinds one to a new connection's socket and form data. So two requests can reach one session object at the same time. Unsynchronised, both could see replyExtraHeaders null, both construct a Vector, and the second assignment discards the first one's header outright. A header that was set and then silently dropped is worse than one never set: the CGI has no way to detect it.
Synchronised on sessionEstablishedTime, which is final and is already this class's monitor – see setCookie(HttpCookie), which this deliberately mirrors. A second lock for a second field in the same object would be two things to reason about instead of one.
Where it is reachable today: the four callers in the tree – DataCollector and three copies of FileDownloadCGI – are all invoked through HttpRequestParser.loadCGIObject, which passes that parser's own per-connection session. So the lost update is not reachable through any current caller. It is fixed regardless, because both methods are public, nothing in the class stops a caller reaching a shared instance, and the shared-instance path is one this class already implements on purpose.
public Enumeration<String> getReplyExtraHeaders()
Returns an enumeration over a SNAPSHOT, not over the live Vector. Synchronising addReplyExtraHeader(String) alone would not have been the fix: the caller – HttpReply.createReplyInternal – iterates whatever is returned here, outside any lock, while another request on the same session may still be adding. A live Vector.elements() enumeration under concurrent modification gives that caller a ConcurrentModificationException or a truncated header list, in the middle of building an HTTP reply.
Copying inside the lock is the same shape as getSetCookies(StringBuilder), which builds its whole result while holding the monitor rather than handing the collection out.
public static long getLongRandom()
From SecureRandom. Callers use this as an unguessable identifier, not merely as a distinct one – see the field comment.
public void setReplyCharset(String charset)
Opt-in, and it changes nothing for any reply that does not call this. The default is InternetCharacterConversion's single-byte codepage, ISO-8859-1 unless server.ini says otherwise, and it stays the default: every NetPhantom web response goes through the same reply path, including the HTML application pages and every customer's own CGI, so changing it globally is not a decision this class gets to make.
The charset is applied in two places that must agree, and both are handled for the caller: the Content-Type HEADER, which is what browsers actually obey, and the encoding of the reply body itself in HttpReply.createNormalReply(HttpSession,String). A charset that reaches only a document's <meta> tag is ignored by every browser, so an opt-in that stopped there would build the mechanism and still ship the wrong encoding.
Only replies produced from a String are re-encoded. A CGI that hands over bytes has already chosen its encoding, and this will not second-guess it.
charset - The character set name, e.g. "UTF-8", or null for the default.public String getReplyCharset()
public void setMultipartCharset(String charset)
Opt-in, and it changes nothing for any session that does not call this. The default stays what it has always been - the request's own definition_charset part if it carries one, and ISO-8859-1 otherwise. Multipart is in live use by customer applications doing file upload, so changing that default is not a decision this class gets to make.
An in-band definition_charset still wins, as does the Internet Explorer workaround that distrusts a browser's UTF-8 claim. This applies only to the request that names no charset at all.
It takes effect on the NEXT multipart request on this session, not the one currently being parsed: the body is decoded while the request is read, before any CGI on that request can run. An application that knows its own encoding sets this once - at login, say - and every subsequent upload on the session is decoded with it.
Both HTML-style and Java-style names are accepted ("UTF-8" and "UTF8"). The name is validated when the parser is built, and an unsupported one raises IllegalArgumentException there - rather than failing the whole request later with a NullPointerException out of Hashtable.put, which is what an unusable charset does once it reaches the decode.
charset - The character set name, e.g. "UTF-8", or null for the default.public String getMultipartCharset()
public static HashMap<String,String> getURIParams(String uriParams, boolean keepCase)
uriParams - the URI parameters to parse, null for none.keepCase - If every parameter is case sensitive, otherwise they are converted to lower case.public HashMap<String,String> getURIParams()
public HashMap<String,String> getURIParams(boolean keepCase)
keepCase - If every parameter is case sensitive, otherwise they are converted to lower case.Phantom® and NetPhantom® are registered trademarks of Mindus SARL.
© 2026 Mindus SARL. All rights reserved.