SessionManagement

Jarvis Sessions

Jarvis supports maintaining client state through the use of sessions. If your application needs to persist and manage information for the client between requests, then you'll probably use sessions.

In Jarvis, a session is a namespace that is referenced in each request. The steps to using sessions are:

1. Enable sessions by setting a few Jarvis configuration settings
2. To initialize a session for a client, the client must first access the SessionStartEndpoint. Jarvis will create the session for the client and return a session ID header in the response.
3. It is imperative that every subsequent request from the client include the session ID header, otherwise Jarvis has no idea what session is associated with the client.
4. The session is referenced by the Session element of the request object that's passed to your application code.
   • REST - the request object is the right argument to your application code.
   • JSON - the request object is the left argument to your application code. (The JSON data is the right argument)

If sessions are enabled, any request other than to SessionStartEndpoint which does not include a session ID Header will result in a "401 Unauthorized" HTTP status.

Session Lifetime
If SessionTimeout is a positive number, as soon as a session is created, the timeout clock starts. When the client makes a request with SessionIdHeader set, the following responses may result:

Condition	Result
A request is made before SessionTimeout has passed	The timeout clock for this session is reset and the request is passed to your application code
A request is made is made after SessionTimeout has passed, but before SessionCleanupTime has passed	The session had timed out and its associated namespace was expunged. Jarvis responds with "408 Session timed out" HTTP status and then all information about the session is removed. The client will need to make a request for SessionStartEndpoint and create a new session to continue.
A request is made after SessionCleanupTime has passed	The session had timed out, its associated namespace was expunged, and all information about the session was removed. Jarvis responds with "403 Invalid session ID" HTTP status. The client will need to make a request for SessionStartEndpoint and create a new session to continue.

Session Configuration Settings

Setting	Description
SessionTimeout	Controls whether sessions are used. Valid values are: 0 - sessions are not used (the default) a number >0 - the number of minutes of inactivity before which Jarvis will timeout and expunge a session ¯1 - sessions are used but Jarvis does not manage session timeouts - it is up to your application to manage how long a session will last.
SessionCleanupTime	The number of minutes (default 60) after which all information about a timed-out session is removed
SessionIdHeader	The name of the header that contains the session ID. Default is 'Jarvis-SessionID'
SessionInitFn	The name of your function, if any, that initializes a new session. Default is ''
SessionPollingTime	The frequency in minutes (default 1) that Jarvis will check for timed out sessions.
SessionStartEndpoint	The name of the endpoint (default 'Login') that the client can request to initiate a session. You do not need to write a function
SessionStopEndpoint	The name of the endpoint (default 'Logout') that the client can request to terminate its session.

A Simple Session Walkthrough