public boolean isValid(HttpSession sess, HttpServletRequest req, boolean create)
  {
    // create local variable - JIT performance improvement
    final boolean isTraceOn = com.ibm.ejs.ras.TraceComponent.isAnyTracingEnabled();
    if (isTraceOn && LoggingUtil.SESSION_LOGGER_CORE.isLoggable(Level.FINE))
    {
      LoggingUtil.SESSION_LOGGER_CORE.entering(methodClassName, methodNames[IS_VALID]);
    }

    ISession isess = ((SessionData) sess).getISession();
    boolean valid = isess.isValid();
    if (valid)
    {
      if (_smc.getIntegrateSecurity())
      {
          try {
              checkSecurity((SessionData)sess, req); // PK01801 check security here - 
                                                     // may result in UnauthorizedSessionRequestException
          } 
          catch (UnauthorizedSessionRequestException unauthException) {
              if (_smc.getInvalidateOnUnauthorizedSessionRequestException()) {
                  valid = false; //let the getSession code handle the invalidation
              } else {
                  if (create || _smc.getThrowSecurityExceptionOnGetSessionFalse()) {
                      throw unauthException;
                  } else {
                      //don't throw the exception if they just requested it with getSession(false)
                      valid=false;
                  }
              }
          }
      }
      if (valid && (_smc.isDebugSessionCrossover()) && (crossoverCheck(req, sess) )) { //PK80539
        valid = false;
        Object parms[] = new Object[] { getAppName(), sess.getId(), getCurrentSessionId() };
        // Needed to create a LogRecord so we could have parameters and a
        // throwable in the same log
        LoggingUtil.logParamsAndException(LoggingUtil.SESSION_LOGGER_CORE, Level.SEVERE, methodClassName, methodNames[IS_VALID], "SessionContext.CrossoverOnRetrieve", parms,
                                          new SessionCrossoverStackTrace());
      }
    }
    if (!valid) // if the session is not valid, then most likely we were processing it on the current thread and then it was invalidated by another thread.
    {
      ((IExtendedRequest) req).setSessionId(null);
      SessionAffinityContext sac = getSessionAffinityContext(req);
      sac.setResponseSessionID(null);
      /* PM73188 - Fixing regression from PM87133. Some customers were seeing a negative active count due to isValid being called multiple times in a row.
      * If the customer still needs this setting on, then they need to set ModifyActiveCountOnInvalidatedSession="true" in server.xml.
      */
      if (_smc.getModifyActiveCountOnInvalidatedSession()) {
          _coreHttpSessionManager.getIStore().getStoreCallback().sessionReleased(isess); // PM87133, since the session is no longer valid, it's also no longer active, we need to decrement active count
      }
    }
    if (isTraceOn && LoggingUtil.SESSION_LOGGER_CORE.isLoggable(Level.FINE))
    {
      LoggingUtil.SESSION_LOGGER_CORE.exiting(methodClassName, methodNames[IS_VALID], "" + valid);
    }
    return valid;
  }
public boolean isValid ( HttpSession sess , HttpServletRequest req , boolean create ) { final boolean isTraceOn = com . ibm . ejs . ras . TraceComponent . isAnyTracingEnabled ( ) ; if ( isTraceOn && LoggingUtil . SESSION_LOGGER_CORE . isLoggable ( Level . FINE ) ) { LoggingUtil . SESSION_LOGGER_CORE . entering ( methodClassName , methodNames [ IS_VALID ] ) ; } ISession isess = ( ( SessionData ) sess ) . getISession ( ) ; boolean valid = isess . isValid ( ) ; if ( valid ) { if ( _smc . getIntegrateSecurity ( ) ) { try { checkSecurity ( ( SessionData ) sess , req ) ; } catch ( UnauthorizedSessionRequestException unauthException ) { if ( _smc . getInvalidateOnUnauthorizedSessionRequestException ( ) ) { valid = false ; } else { if ( create || _smc . getThrowSecurityExceptionOnGetSessionFalse ( ) ) { throw unauthException ; } else { valid = false ; } } } } if ( valid && ( _smc . isDebugSessionCrossover ( ) ) && ( crossoverCheck ( req , sess ) ) ) { valid = false ; Object parms [ ] = new Object [ ] { getAppName ( ) , sess . getId ( ) , getCurrentSessionId ( ) } ; LoggingUtil . logParamsAndException ( LoggingUtil . SESSION_LOGGER_CORE , Level . SEVERE , methodClassName , methodNames [ IS_VALID ] , "SessionContext.CrossoverOnRetrieve" , parms , new SessionCrossoverStackTrace ( ) ) ; } } if ( ! valid ) { ( ( IExtendedRequest ) req ) . setSessionId ( null ) ; SessionAffinityContext sac = getSessionAffinityContext ( req ) ; sac . setResponseSessionID ( null ) ; if ( _smc . getModifyActiveCountOnInvalidatedSession ( ) ) { _coreHttpSessionManager . getIStore ( ) . getStoreCallback ( ) . sessionReleased ( isess ) ; } } if ( isTraceOn && LoggingUtil . SESSION_LOGGER_CORE . isLoggable ( Level . FINE ) ) { LoggingUtil . SESSION_LOGGER_CORE . exiting ( methodClassName , methodNames [ IS_VALID ] , "" + valid ) ; } return valid ; }
/*
isValid - called by webcontainer to ensure its ok to give out the session
he has cached for the request