Intercept calls to HttpSession in Tomcat 6

Question

What's the recommended approach to intercepting session.getAttribute() and session.setAttribute()? This is in a Spring based application so something AOP-based would be great. I'd like to avoid having to override core Tomcat classes if possible.

Update: I want to store the actual serialized attributes in a web service.

Answer 1

I am not familiar with AOP or Spring (or Tomcat). :) But I am familliar with Java

The way I do it is set up a filter, and replace the request variable with my own object

request = new MyRequest(request);

Then override getSession() and getSession(boolean) to return an instance of MySession

the javax.servlet.HttpServletRequest and javax.servlet.HttpSession classes are Java EE standard and not Tomcat specific.

Answer 2

You could implement your own session org.apache.catalina.Manager and swap it into Tomcat's configuration, although the interface looks rather lengthy - so perhaps look at extending ManagerBase or StandardManager first.

As an alternative, register a HttpSessionAttributeListener to be notified whenever a session attribute is added/removed/updated. This won't change the default storage mechanism - the session data will still be kept in-memory as well - but it would let you persist the data with an alternative mechanism as well.