session
一、规范中的SESSION描述
（PortletSession objects must be scoped at the portlet application context level. Each portlet application has its own distinct PortletSession object per user session. The portlet container must not share the PortletSession object or the attributes stored in it among different portlet applications or among different user sessions.）上面这段话是portlet规范里的一段。很明白的可以看出，每个Portlet Application应该在Process Action和Render的时候应该拥有自己私有的Session对象，来为当前用户服务。也就是说，如果某一个用户在一个PORTAL系统中操作不同的PORTLET，而且这些PORTLET属于不同的PORTLET APPLICATION，则，这个用户将操作多个SESSION对象，用户在每个PORTLET中操作SESSION时，这个SESSION都将是属于该PORTLET所在的上下文的私有SESSION 对象。比如，用户当前页面有三个PORTLET，每个PORTLET都属于不同的PORTLET APPLICATION。则当该用户在第一个PORTLET里面有对SESSION的操作后，该PORTLET所属的APPLICATION将为这个用户生成一个SESSION；当该用户又操作第二个PORTLET中的SESSION时，该上下文有会对此用户产生一个新的SESSION对象；第三个依然如此。加上PORTAL系统的SESSION，也就是该用户实际和四个SESSION在大交道。
另外要说明一点的是，PORTLET APPLICATION和WEB APPLICATION的关系。规范中有如下的定义：（Portlets, servlets and JSPs are bundled in an extended web application called portlet application. Portlets, servlets and JSPs within the same portlet application share class loader, application context and session. ）这说明PORTLET APPLICATION其实就是一个WEB APPLICATION。规范中还有一段话更是说明了这个问题，同时也强调了PORTLET SESSION 和普通的该APPLICATION的SESSION的关系：（A Portlet Application is also a Web Application. The Portlet Application may contain servlets and JSPs in addition to portlets. Portlets, servlets and JSPs may share information through their session. The PortletSession must store all attributes in the HttpSession of the portlet application. A direct consequence of this is that data stored in the HttpSession by servlets or JSPs is accessible to portlets through the PortletSession in the portlet application scope. Conversely, data stored by portlets in the PortletSession in the portlet application scope is accessible to servlets and JSPs through the HttpSession. If the HttpSession object is invalidated, the PortletSession object must also be invalidated by the portlet container. If the PortletSession object is invalidated by a portlet, the portlet container must invalidate the associated HttpSession object.）
最后一点要说明的是怎样得到PORTLET SESSION对象。规范中有这样一个例子：PortletSession session = request.getSession(true);URL url = new URL(“http://www.foo.com“);session.setAttribute(“home.url”,url,PortletSession.APPLICATION_SCOPE);session.setAttribute(“bkg.color”,”RED”,PortletSession.PORTLET_SCOPE);