Miscellaneous Tips and Bits

To access the SSL session ID from the request, use:

String sslID = (String)request.getAttribute(“javax.servlet.request.ssl_session_id”);

 

To terminate an SSL session, use:

// Standard HTTP session invalidation

session.invalidate();

 

// Invalidate the SSL Session

org.apache.tomcat.util.net.SSLSessionManager mgr =

(org.apache.tomcat.util.net.SSLSessionManager)

request.getAttribute(“javax.servlet.request.ssl_session_mgr”);

mgr.invalidateSession();

 

// Close the connection since the SSL session will be active until the connection

// is closed

response.setHeader(“Connection”, “close”);