IdHTTPServer and session management Tutorial

[rlebeau]

Based on my experience with TidTCPServer I would like to do the following comparisons : 

1. with TCPServer we can use the "AContext: TIdContext" to manage authentication and specific client management. 
   
2. we can use the onconnect and ondisconnect events at the beginning and at the end.
   
3. we can create a "TMyClient = class(TidServerContext)" to keep memory of the session between each automatic run of the TCPServer OnExecute
   
4. we can use TCPserver.Contexts.Locklist to perform safe operations across active connections (count, send message, .....).
   

All of those items exist in TIdHTTPServer as well, since it is a TIdTCPServer descendant after all (well, TIdCustomTCPServer, anyway).

However, TIdContext is per-connection, not per-session.  HTTP requests are not restricted to just 1 connection per session.

1. there is also HTTPserver.Contexts.Locklist but I don't see any access to the sessions list and there is also the HTTPServer.SessionList but I have not seen if it's possible to use it to get access to each Session data and how to do it safely.
   

No, HTTP session data is not directly accessible via TIdContext, because that is not where the session data belongs.  TIdHTTPRequestInfo and TIdHTTPResponseInfo have a Session property instead, since those objects are handled on a per-request basis, regardless of which connection is making each request.

Though, you can type-cast a server-side TIdContext to TIdServerContext to access its Server property, which you can then type-cast to TIdHTTPServer to access its SessionList property.

And yes, the TIdHTTPServer.SessionList is where you can access all of the server's stored session data.  TIdHTTPCustomSessionList has a GetSession() method, if you know the exact SessionID and RemoteIP of a given session.  By default, the TIdHTTPServer.SessionList property points to a TIdHTTPDefaultSessionList object (if you don't assign your own object), which has its own SessionList property that is a TThreadList of TIdHTTPSession objects (similar to how the TIdTCPServer.Contexts is a TThreadList of TIdContext objects).  Or, you can derive your own class from TIdHTTPCustomSessionList and store session data however you want.