public class StandardSessionFacade implements HttpSession 

 private final HttpSession session;
 public StandardSessionFacade(HttpSession session) {
 this.session = session;
 }

 @GetMapping("/s")
 public String sessionTest(HttpSession httpSession) throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
 StandardSessionFacade session = (StandardSessionFacade) httpSession;
 Class targetClass = Class.forName(session.getClass().getName());

 //修改可見(jiàn)性
 Field standardSessionField = targetClass.getDeclaredField("session");
 standardSessionField.setAccessible(true);
 //獲取
 StandardSession standardSession = (StandardSession) standardSessionField.get(session);
 
 return standardSession.getManager().toString();
 }

public class StandardSession implements 
HttpSession, Session, Serializable

 @GetMapping("/s")
 public void sessionTest(HttpSession httpSession, HttpServletResponse response) throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException, IOException {
 StandardSessionFacade session = (StandardSessionFacade) httpSession;
 Class targetClass = Class.forName(session.getClass().getName());

 //修改可見(jiàn)性
 Field standardSessionField = targetClass.getDeclaredField("session");
 standardSessionField.setAccessible(true);
 //獲取
 StandardSession standardSession = (StandardSession) standardSessionField.get(session);
 
 //存點(diǎn)數(shù)據(jù)以便觀(guān)察
 standardSession.setAttribute("msg","hello,world");
 standardSession.setAttribute("user","kesan");
 standardSession.setAttribute("password", "點(diǎn)贊");
 standardSession.setAttribute("tel", 10086L);
 //將序列化的結(jié)果直接寫(xiě)到Http的響應(yīng)中
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(response.getOutputStream());
 
 standardSession.writeObjectData(objectOutputStream);
 }

 public void setAttribute(String name, Object value, boolean notify) {
 //省略無(wú)關(guān)代碼
  //獲取上文中配置的事件監(jiān)聽(tīng)器
 Object listeners[] = context.getApplicationEventListeners();
 if (listeners == null) {
  return;
 }
 for (int i = 0; i < listeners.length; i++) {
  //只有HttpSessionAttributeListener才可以執(zhí)行
  if (!(listeners[i] instanceof HttpSessionAttributeListener)) {
  continue;
  }
  HttpSessionAttributeListener listener = (HttpSessionAttributeListener) listeners[i];
  try {
  //在當(dāng)前線(xiàn)程調(diào)用監(jiān)聽(tīng)器的處理方法
  if (unbound != null) {
   if (unbound != value || manager.getNotifyAttributeListenerOnUnchangedValue()) {
   //如果是某個(gè)鍵的值被修改則調(diào)用監(jiān)聽(tīng)器的attributeReplaced方法
   context.fireContainerEvent("beforeSessionAttributeReplaced", listener);
   if (event == null) {
    event = new HttpSessionBindingEvent(getSession(), name, unbound);
   }
   listener.attributeReplaced(event);
   context.fireContainerEvent("afterSessionAttributeReplaced", listener);
   }
  } else {
   //如果是新添加某個(gè)鍵則執(zhí)行attributeAdded方法
   context.fireContainerEvent("beforeSessionAttributeAdded", listener);
   if (event == null) {
   event = new HttpSessionBindingEvent(getSession(), name, value);
   }
   listener.attributeAdded(event);
   context.fireContainerEvent("afterSessionAttributeAdded", listener);
  }
  } catch (Throwable t) {
  //異常處理
  }
 }
 }

 public StandardSession(Manager manager) {
 //調(diào)用Object類(lèi)的構(gòu)造方法,默認(rèn)已經(jīng)調(diào)用了
 //此處再聲明一次，不知其用意，或許之前此類(lèi)有父類(lèi)?
 super();
 
 this.manager = manager;
 //是否開(kāi)啟訪(fǎng)問(wèn)計(jì)數(shù)
 if (ACTIVITY_CHECK) {
  accessCount = new AtomicInteger();
 }
 }

protected Map<String, Session> sessions = new ConcurrentHashMap<>();

 public Session createSession(String sessionId) {
 //檢查Session是否超過(guò)限制,如果是則拋出異常
 if ((maxActiveSessions >= 0) &&
  (getActiveSessions() >= maxActiveSessions)) {
  rejectedSessions++;
  throw new TooManyActiveSessionsException(
   sm.getString("managerBase.createSession.ise"),
   maxActiveSessions);
 }

 //該方法會(huì)創(chuàng)建StandardSession對(duì)象
 Session session = createEmptySession();

 //初始化Session中必要的屬性
 session.setNew(true);
 //session是否可用
 session.setValid(true);
 //創(chuàng)建時(shí)間
 session.setCreationTime(System.currentTimeMillis());
 //設(shè)置session最大超時(shí)時(shí)間
 session.setMaxInactiveInterval(getContext().getSessionTimeout() * 60);
 String id = sessionId;
 if (id == null) {
  id = generateSessionId();
 }
 session.setId(id);
 sessionCounter++;
 //記錄創(chuàng)建session的時(shí)間，用于統(tǒng)計(jì)數(shù)據(jù)session的創(chuàng)建速率
 //類(lèi)似的還有ExpireRate即Session的過(guò)期速率
 //由于可能會(huì)有其他線(xiàn)程對(duì)sessionCreationTiming操作因此需要加鎖
 SessionTiming timing = new SessionTiming(session.getCreationTime(), 0);
 synchronized (sessionCreationTiming) {
  //sessionCreationTiming是LinkedList
  //因此poll會(huì)移除鏈表頭的數(shù)據(jù)，也就是最舊的數(shù)據(jù)
  sessionCreationTiming.add(timing);
  sessionCreationTiming.poll();
 }
 return session;
 }

 @Override
 public void remove(Session session, boolean update) {
 //檢查是否需要將統(tǒng)計(jì)過(guò)期的session的信息
 if (update) {
  long timeNow = System.currentTimeMillis();
  int timeAlive =
  (int) (timeNow - session.getCreationTimeInternal())/1000;
  updateSessionMaxAliveTime(timeAlive);
  expiredSessions.incrementAndGet();
  SessionTiming timing = new SessionTiming(timeNow, timeAlive);
  synchronized (sessionExpirationTiming) {
  sessionExpirationTiming.add(timing);
  sessionExpirationTiming.poll();
  }
 }
 //將session從Map中移除
 if (session.getIdInternal() != null) {
  sessions.remove(session.getIdInternal());
 }
 }

 public void invalidate() {

 if (!isValidInternal())
  throw new IllegalStateException
  (sm.getString("standardSession.invalidate.ise"));

 // Cause this session to expire
 expire();
 }

 @Override
 public void expire() {

 expire(true);

 }
 public void expire(boolean notify) {
  //省略代碼
  //將session從ConcurrentHashMap中移除
  manager.remove(this, true);
  //被省略的代碼主要是將session被銷(xiāo)毀的消息通知
  //到各個(gè)監(jiān)聽(tīng)器上
 }

 @Override
 public void backgroundProcess() {
 count = (count + 1) % processExpiresFrequency;
 if (count == 0)
  processExpires();
 }

 public void processExpires() {

 long timeNow = System.currentTimeMillis();
 Session sessions[] = findSessions();
 int expireHere = 0 ;

 if(log.isDebugEnabled())
  log.debug("Start expire sessions " + getName() + " at " + timeNow + " sessioncount " + sessions.length);
 //從JConsole的圖中可以看出isValid可能導(dǎo)致expire方法被調(diào)用
 for (int i = 0; i < sessions.length; i++) {
  if (sessions[i]!=null && !sessions[i].isValid()) {
  expireHere++;
  }
 }
 long timeEnd = System.currentTimeMillis();
 if(log.isDebugEnabled())
  log.debug("End expire sessions " + getName() + " processingTime " + (timeEnd - timeNow) + " expired sessions: " + expireHere);
 processingTime += ( timeEnd - timeNow );

 }

 /**
 * This method will be invoked by the context/container on a periodic
 * basis and allows the manager to implement
 * a method that executes periodic tasks, such as expiring sessions etc.
 */
 public void backgroundProcess();

//bad
httpSession.setAttribute("user","kesan");
httpSession.setAttribute("nickname","點(diǎn)贊");
httpSession.setAttribute("sex","男");
....

//good
User kesan = userDao.getUser()
httpSession.setAttribute("user", kesan);