Fix for bug 43839. When cookie based session tracking has been disabled, URL based...

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@606944 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/catalina/connector/CoyoteAdapter.java b/java/org/apache/catalina/connector/CoyoteAdapter.java
index 1842d1f..ad91350 100644 (file)
--- a/java/org/apache/catalina/connector/CoyoteAdapter.java
+++ b/java/org/apache/catalina/connector/CoyoteAdapter.java
@@ -524,6 +524,13 @@ public class CoyoteAdapter
      */
     protected void parseSessionCookiesId(org.apache.coyote.Request req, Request request) {
 
+        // If session tracking via cookies has been disabled for the current
+        // context, don't go looking for a session ID in a cookie as a cookie
+        // from a parent context with a session ID may be present which would
+        // overwrite the valid session ID encoded in the URL
+        if (!((Context)request.getMappingData().context).getCookies())
+            return;
+        
         // Parse session id from cookies
         Cookies serverCookies = req.getCookies();
         int count = serverCookies.getCookieCount();