Session Management

http is stateless protocol, which means by its inherent nature , It will not maintain any session. To maintain a session in websites like shopping websites,we need a session management mechanism like cookies, URL rewriting , file persistence, JVM in-memory session management etc...

Considering performance , Maintaining session information in JVM is the best method of session management.

Considering security, Maintaining session on Database is the best method of session management.

Cookies are also used in some cases , but you will compromise on security. If you choose Cookies over SSL , you will compromise on performance

Session Management: We could decide the idle time, after what time the session could expire of the user ..etc.The cookies store the user credentials,so that user doesnt need to reenter credentials again and again in a valid session.SSL is used to secure the information or data exchanging between the user and client over the internet.So that, we could reduce the data hacking.

The ideal timeout of the logged in USER session in the application.