@Override
    public HttpSession getSession(boolean create) {
      if (session != null && session.isValid()) {
        session.setIsNew(false);
        session.updateAccessTime();
        return session;
      }

      if (requestedSessionId != null) {
        session = (GemfireHttpSession) manager.getSession(requestedSessionId);
        if (session != null) {
          session.setIsNew(false);
          // This means we've failed over to another node
          if (session.getServletContext() == null) {
            session.setServletContext(context);
          }
        }
      }

      if (session == null || !session.isValid()) {
        if (create) {
          HttpSession nativeSession = super.getSession();
          try {
            session = (GemfireHttpSession) manager.wrapSession(context,
                nativeSession.getMaxInactiveInterval());
            session.setIsNew(true);
            manager.putSession(session);
          } finally {
            nativeSession.invalidate();
          }
        } else {
          // create is false, and session is either null or not valid.
          // The spec says return a null:
          return null;
        }
      }

      if (session != null) {
        addSessionCookie(response);
        session.updateAccessTime();
      }

      return session;
    }
Create our own sessions. TODO: Handle invalidated sessions

@return a HttpSession
extensions/geode-modules-session/src/main/java/org/apache/geode/modules/session/filter/SessionCachingFilter.java