Keeping detached instances in Httpsession or not?

[vmarcinko]

Hi everyone.

Im using Hibernate for my CRUD web app, and want to find out how do people usualy use Hibernate for web *update* process?
Maybe you read Hibernate In Action book, and there are presented 3 ways of doing this :
1. Storing object ID as hidden form field, thus being forced to load this object upon submit before populating it with new values (most simple but not performant)
2. Storing it in a HttpSession, and reattaching it later (HttpSession is best avoided in web development due to back-button effect, and performance in clusters; also complicating code with Session.lock() calls)
3. Keeping Session open during multiple request? (fancy ServletFilter usage)

Also, if one prefers 2. or 3. solution, where do you place removal of detached object from HttpSession (user can press back button and go somewhere else, without submitting form, and your object is still in HttpSession)?

Thanx,
Vjeran

[tentacle]

Your position in the HTTP session discussion - IMO - depends on what's most important to you.

You discuss issues that are all related to technical aspects: performance, clustering, memory usage.

To me to most important issue is concurrent update detection using optimistic locking. Optimistic locking is a powerful feature but your application has to use it. Storing an object in the HTTP session when rendering an update screen and retrieving it from the HTTP session when submitting is the only sure way to trigger optimistic locking exceptions (concurrent update). If you do not use the HTTP session users will overwrite updates they have not seen.

Technical issues can be important for large applications but to me concurrent update exceptions come first.

[vmarcinko]

Thx.

Since I'm total newbie with this HttpSession form aproach, could you tell me are there some problems people are experiencing when keeping detached objects in HttpSession ?
Assaf mentioned once some problem when HttpSession timeouts, though it doesn't sound like some big problem to me, so do you know more problems with these kinds of forms (I heard you call it "session" forms; I guess Spring web framework has it, but Im using other framework for web)?

-Vjeran