《一线大厂Java面试题解析+核心总结学习笔记+最新讲解视频+实战项目源码》,点击传送门,即可获取!
return AccessController.
doPrivileged(new GetSessionPrivilegedAction(create));
} else {
// RequestFacade 是个外观模式实现,核心请求还是会传递给 Request处理的
// org.apache.catalina.connector.Request
return request.getSession(create);
}
}
// org.apache.catalina.connector.Request#getSession(boolean)
/**
- @return the session associated with this Request, creating one
- if necessary and requested.
- @param create Create a new session if one does not exist
*/
@Override
public HttpSession getSession(boolean create) {
// 由 create 字段决定是否需要创建新的session, 如果不存在的话。
// Session 是tomcat的一个会话实现类,并非对接规范接口类,其会包装一个HttpSession,以便统一交互
// 因为只有 HttpSession 才是 Servlet 的接口规范,在tomcat中会以 StandardSessionFacade 实现接口,其也是一个外观模式的实现,具体工作由 StandardSession 处理。
Session session = doGetSession(create);
if (session == null) {
return null;
}
// 包装 Session 为 HttpSession 规范返回
return session.getSession();
}
// org.apache.catalina.connector.Request#doGetSession
protected Session doGetSession(boolean create) {
// There cannot be a session if no context has been assigned yet
// mappingData.context;
Context context = getContext();
if (context == null) {
return (null);
}
// Return the current session if it exists and is valid
// 此处检查session有效性时,也会做部分清理工作
if ((session != null) && !session.isValid()) {
session = null;
}
if (session != null) {
return (session);
}
// Return the requested session if it exists and is valid
// 获取manager 实例,即真正进行 Session 管理的类,其实主要分两种:1. 基于内存;2. 基于文件的持久化;
Manager manager = context.getManager();
if (manager == null) {
return (null); // Sessions are not supported
}
if (requestedSessionId != null) {
try {
// 如果不是第一次请求,则会带上服务返回的 sessionId, 就会主动查找原来的session
// 从 sessions 中查找即可
session = manager.findSession(requestedSessionId);
} catch (IOException e) {
session = null;
}
if ((session != null) && !session.isValid()) {
session = null;
}
// 后续请求,每次请求都会更新有效时间
if (session != null) {
session.access();
return (session);
}
}
// Create a new session if requested and the response is not committed
// 主动请求session时,才会继续后续逻辑
if (!create) {
return (null);
}
if (response != null
&& context.getServletContext()
.getEffectiveSessionTrackingModes()
.contains(SessionTrackingMode.COOKIE)
&& response.getResponse().isCommitted()) {
throw new IllegalStateException(
sm.getString(“coyoteRequest.sessionCreateCommitted”));
}
// Re-use session IDs provided by the client in very limited
// circumstances.
String sessionId = getRequestedSessionId();
if (requestedSessionSSL) {
// If the session ID has been obtained from the SSL handshake then
// use it.
} else if ((“/”.equals(context.getSessionCookiePath())
&& isRequestedSessionIdFromCookie())) {
/* This is the common(ish) use case: using the same session ID with
- multiple web applications on the same host. Typically this is
- used by Portlet implementations. It only works if sessions are
- tracked via cookies. The cookie must have a path of “/” else it
- won’t be provided for requests to all web applications.
- Any session ID provided by the client should be for a session
- that already exists somewhere on the host. Check if the context
- is configured for this to be confirmed.
*/
if (context.getValidateClientProvidedNewSessionId()) {
boolean found = false;
for (Container container : getHost().findChildren()) {
Manager m = ((Context) container).getManager();
if (m != null) {
try {
if (m.findSession(sessionId) != null) {
found = true;
break;
}
} catch (IOException e) {
// Ignore. Problems with this manager will be
// handled elsewhere.
}
}
}
if (!found) {
sessionId = null;
}
}
} else {
// 当session无效时,需要将原来的seesionId置空,删除并新创建一个使用
sessionId = null;
}
// 创建session, StandardManager -> ManagerBase
session = manager.createSession(sessionId);
// Creating a new session cookie based on that session
if (session != null
&& context.