@ Override public void doFilter ( final ServletRequest request , final ServletResponse response , final FilterChain chain ) throws IOException , ServletException { HttpServletRequest httpRequest = ( HttpServletRequest ) request ; HttpServletResponse httpResponse = ( HttpServletResponse ) response ; if ( isRequestedSessionIdFromURL ( httpRequest ) ) { HttpSession session = httpRequest . getSession ( false ) ; if ( session != null ) { session . invalidate ( ) ; // clear session if session id in URL } } // wrap response to remove URL encoding HttpServletResponseWrapper wrappedResponse = new HttpServletResponseWrapper ( httpResponse ) { @ Override public String encodeRedirectUrl ( final String url ) { return url ; } @ Override public String encodeRedirectURL ( final String url ) { return url ; } @ Override public String encodeUrl ( final String url ) { return url ; } @ Override public String encodeURL ( final String url ) { return url ; } } ; chain . doFilter ( request , wrappedResponse ) ; }
Filters requests to remove URL - based session identifiers .