Session handling

This section describes how the Web client uses HTTP sessions to manage the MQ Workflow sessions for the logged-on users.

For the Web client, HTTP sessions must be based on cookies. Using URL-rewriting for implementing HTTP session objects is not yet supported. An HTTP session is lost if a cookie expires, which is after 30 minutes as a common default. An HTTP session cannot be established if the browser has not enabled cookies. The Web client only creates HTTP session objects during logon and invalidates them during logoff. If you do not want the Web client to manage the HTTP sessions, you can set the OwnsHttpSessions parameter in the WebClient.properties file to 'false'. If the parameter is set to 'false', you must ensure that the HTTP session object already exists before the Web client receives the first request. In addition, remember to clean up the HTTP session once it is no longer needed.

The HTTP session handling of the Web client depends on the underlying implementation of the servlet APIs. Therefore, the behavior of the Web client can change if the APIs are changed.

Receiving a logon request

If the Web client receives a logon request, it checks whether an HTTP session object is already associated with the request. If yes, the Web client checks if the connection is established to the same MQ Workflow server, and if this is true, the MQ Workflow session is reused. If the connection is to a different MQ Workflow server, the existing MQ Workflow session is logged off and a new session is established. If no HTTP session exists yet, a new one will be created regardless of the 'OwnsHttpSessions' setting in the WebClient.properties file.

An MQ Workflow session can have the following modes: DEFAULT, PRESENT or PRESENT_HERE, respectively. The Web client uses the DEFAULT mode as default when creating sessions. If you select 'force' on the logon page, the Web client uses the PRESENT_HERE mode instead. You can also write your own logon page and use any of the session modes for the mode parameter. The shipped logon page only supports the DEFAULT mode and PRESENT_HERE mode.

You can log on as many MQ Workflow users as you want if you use the session mode DEFAULT, whereas you can log on a user only once when you use the PRESENT mode. If you open more than one session in the PRESENT mode, an error message ist displayed. To open another session in the present mode without logging off the previously opened session, you must use the PRESENT_HERE mode. This mode logs off the existing PRESENT session and opens the new session.

Receiving a logoff request

If the Web client receives a logoff request, it checks whether an HTTP session object is already associated with the request. If yes, the MQ Workflow session is terminated and the HTTP session invalidated. If the "OwnsHttpSessions" setting in the WebClient.properties file is set to 'false', the HTTP session remains untouched. If no HTTP session is associated with the request, the request is ignored and no error message is displayed.

Receiving a request other than logon or logoff

If the Web client receives a request other than logon or logoff, it checks whether an HTTP session object is already associated with the request. If yes, the existing session is used for the request. If there is no HTTP session and you use the JSPViewer, the logon page is spliced and the request is retried after a successful re-logon. If you use the DefaultViewer, a "no active session" exception is thrown.