How to check if a session is invalid

问题:

How to check if a session is invalid or not? There is no method in the API.

Is it the same as isNew()? And what is the difference if not?

回答1:

If you want to know whether it valid based on a request:

request.isRequestedSessionIdValid()

  or

HttpSession sess = request.getSession(false);
if (sess != null) {
   // it's valid
}

If you have stored a reference to the session and need to validate I would

try {
  long sd = session.getCreationTime();
} catch (IllegalStateException ise) {
  // it's invalid
}

回答2:

isNew() is true only if this session wasn't yet accepted by client (i.e. it was just created, and JSESSIONID wasn't sent yet, or if it was sent, client didn't send it back, so server doesn't know about it and created another session)

回答3:

For all intents and purposes, yes. However, it will throw an IllegalStateException if called on a session invalidated in the same request-response cycle.