Apple WebObjects 3.5 - Manual (Page 76)

Chapter 5 WebObjects Viewed Through Its Classes
76
transactions from that of another, session IDs must not be easily predicted or
faked. To this end, WebObjects uses randomly generated 32-digit integers as
session IDs. (You can also override WOSession’s
sessionID method and implement
another security scheme if you’d like.)
The application keeps existing, active sessions in the WOSessionStore object.
The application object uses the session ID to retrieve the appropriate session
from the session store (see Figure 22). The appropriate session object is then
sent the
awake message to prepare it for the request.
Figure 22. Associating a Request With a Session Object
Creating or Restoring the Request Page
After the session receives the awake message, the next step is to find the request
page. Each request received by a WebObjects application is associated with one
of the application’s pages—the request page. The request page is usually the
response page from the last request. (The response page shows the result, or
output, of the request.)
If the user has just begun a new session (that is, if the request URL looks like
the one shown in Figure 20), the user has not requested a specific page.
Therefore, the application object creates a new instance of the WOComponent
http://ursa/cgi-bin/WebObjects/CyberWind.woa/193354715182610083803983707751271/Main.wo/62793212911/0.1.0/-/ursa
WebObjects
applications
"CyberWind"
session
session
session
session
115182610354478370775108387039932
193354715182610083803983707751271
298371518295496879423495129469577
121458576092359769455670990532240
session
store
HTTP
server
"ursa"