String sessionId, String source )
{
BaseInterceptor reqI[]= request.getContainer().
getInterceptors(Container.H_findSession);
ServerSession sess=null;
for( int i=0; i< reqI.length; i++ ) {
sess=reqI[i].findSession( request,
sessionId, false );
if( sess!=null ) break;
}
/* The following block of code verifies if Tomcat session matches
SSL session (if one was ever passed to Tomcat). Just in case
somebody is trying to steal Tomcat sessions over SSL.
We can't verify that if SSL is not used. */
// Do this only if request is over SSL
if(checkSSLSessionId && sess != null && request.isSecure() ){
// SSL session ID from session and request - they have to be equal!
String ids=(String)sess.getAttribute("javax.servlet.session.ssl_session"),
idr=(String)request.getAttribute("javax.servlet.request.ssl_session");
if(debug>0) cm.log("Request SSL ID="+idr+", Session SSL ID="+ids);
if(idr != null){ // Only do this if there is an SSL session ID
if(ids != null){ // Do we have a stored SSL session ID from before?
if(!ids.equals(idr)){ // Is someone cheating?
sess=null; // No sessions for thugs
cm.log("SECURITY WARNING: SSL session "+idr+
" doesn't match Tomcat session "+sessionId+"!");
}
} else { // First time, save the SSL session ID
sess.setAttribute("javax.servlet.session.ssl_session",idr);
}
} else { // Check requested but no SSL session ID, scream about it!
cm.log("SECURITY WARNING: checkSSLSessionId requested, "+
"but no SSL session ID available!");
}
}
if (sess != null) {
request.setRequestedSessionId( sessionId );
request.setSessionIdSource( source );
// since we verified this sessionID, we can also set
// it and adjust the session
request.setSession( sess );
request.setSessionId( sessionId );
sess.touch( System.currentTimeMillis() );
// if the session was NEW ( never accessed - change it's state )
if( sess.getState() == ServerSession.STATE_NEW ) {
sess.setState( ServerSession.STATE_ACCESSED, request);
}
}
return sess;
}