Is there a way to implement custom session tracking at the container level?
I'm trying to figure out how to implement a custom session tracking method. I have a legacy client that interacts with a set of cgi scripts and I'd like to port those scripts to servlets. I'm running into a problem because the client passes session ids as a query parameter named 'session-num' (e.g.: /update?session-num=TOKEN). The client does not support cookies and there is no way to tell it use a JSESSIONID encoded in the path.
I've followed the code as best as I can starting at org.apache.coyote.tomcat5.CoyoteAdapter parses the JSESSIONID from the request/cookies to where the org.apache.catalina.Manager fetches the org.apache.catalina.Session and I don't see anyway to directly override the session tracking behavior.
The best idea I currently have is to use a Valve and a custom Manager and hope none of the Manager.{create,find}Session() methods are called before my Valve can parse the request and stuff the "session-num" in a ThreadLocal that Manager can use when returning a Session.
That feels ugly and fragile to me. Does anyone have a better solution?
Sandy McArthur
PGP.sig
Description: This is a digitally signed message part
