Source:
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest req = (HttpServletRequest) request; boolean persistentAuth = FiltersHelper.isPersistentAuth(req); HttpSession session = req.getSession(false); if (persistentAuth) { session = req.getSession(true); try { int ttlValue = Integer.parseInt(req.getHeader("Session-TTL")) * SECONDS_IN_MINUTE; if (ttlValue >= MINIMAL_SESSION_TTL) { session.setMaxInactiveInterval(ttlValue); } } catch (NumberFormatException ex) { log.error("Session-TTL header was not passed. Not setting TTL value"); } } String engineSessionId = (String) req.getAttribute(SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY); if (engineSessionId != null && session != null) { session.setAttribute( SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY, engineSessionId ); } else { if (session.getAttribute(SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY) != null) request.setAttribute(SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY, session.getAttribute(SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY)); } chain.doFilter(request, response); try { if (FiltersHelper.isAuthenticated(req)) { if (!persistentAuth) { InitialContext ctx = new InitialContext(); try { FiltersHelper.getBackend(ctx).runAction( VdcActionType.LogoutBySession, new VdcActionParametersBase( (String) req.getAttribute(SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY) ) ); req.getSession().invalidate(); } finally { ctx.close(); } } else { session = req.getSession(false); if (session != null && session.isNew() && req.getAttribute(FiltersHelper.Constants.REQUEST_ASYNC_KEY) == null || !Boolean.valueOf((boolean) req.getAttribute(FiltersHelper.Constants.REQUEST_ASYNC_KEY))) { ((HttpServletResponse) response).addHeader(FiltersHelper.Constants.HEADER_JSESSIONID_COOKIE, session.getId()); } } } } catch (Exception ex) { log.error("Error in REST-API session management. ", ex); } }

Target:
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest req = (HttpServletRequest) request; String engineSessionId = (String) request.getAttribute(SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY); if (engineSessionId == null) { HttpSession session = req.getSession(false); if (session != null) { engineSessionId = (String) session.getAttribute(SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY); if (engineSessionId != null) { request.setAttribute(SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY, engineSessionId); } } } if (engineSessionId == null) { throw new ServletException("No engine session"); } boolean persistentAuth = FiltersHelper.isPersistentAuth(req); if (persistentAuth) { HttpSession session = req.getSession(true); session.setAttribute(SessionConstants.HTTP_SESSION_ENGINE_SESSION_ID_KEY, engineSessionId); try { int ttlValue = Integer.parseInt(req.getHeader("Session-TTL")) * SECONDS_IN_MINUTE; if (ttlValue >= MINIMAL_SESSION_TTL) { session.setMaxInactiveInterval(ttlValue); } } catch (NumberFormatException ex) { log.error("Session-TTL header was not passed. Not setting TTL value"); } } chain.doFilter(request, response); try { if (FiltersHelper.isAuthenticated(req)) { if (persistentAuth) { if (!Boolean.TRUE.equals(request.getAttribute(SessionConstants.REQUEST_ASYNC_KEY))) { HttpSession session = req.getSession(false); if (session != null) { ((HttpServletResponse) response).addHeader(FiltersHelper.Constants.HEADER_JSESSIONID_COOKIE, session.getId()); } } } else { InitialContext ctx = new InitialContext(); try { FiltersHelper.getBackend(ctx).runAction( VdcActionType.LogoutBySession, new VdcActionParametersBase(engineSessionId) ); HttpSession session = req.getSession(false); if (session != null) { session.invalidate(); } } finally { ctx.close(); } } } } catch (Exception ex) { log.error("Error in REST-API session management. ", ex); throw new ServletException(ex); } }