A common mistake web developers do is to put anything and everything in session (a session is a special type of object provided by the web technology/framework to store objects within it that will be retained from the time a user enters the system till he/she leaves the system). A session level object occupies memory till the user session is closed. There are three ways a session could be closed.
- If there is a logout link in the application, clicking on that link would logout the user as well as clear all the user’s session related objects.
- The user might close the browser window abruptly.
- The user is idle for some time and a session timeout is set to clear off all his session details. This is what would happen after some time in case of point 2.
You are in control in case of point 1, but in case of point 2 and point 3 there are going to be some delay in terms of really clearing the session in which case the objects for a session would remain in the memory. We are talking about one single user’s session here, but when the web application is in production it is going to be hit by more than one user at a time. Say if the number of hits expected to your site is n; multiply it by the number of objects that you have stored in your session. That many objects would reside in the memory.
So you have to be really stingy in using sessions and wherever a value is needed only for a request, use the objects at a request level scope, so that once the response is sent back, the objects for that request are cleared. Store objects in session that will really be needed throughout the user’s session. For example the user’s login details might be necessary to make sure only a user who has logged in is able to access certain pages. Consciously deciding on what to go into session and what not is very important and can save memory on your server which in turn could increase the load capable by your server.