@SuppressWarnings({"checkstyle:CyclomaticComplexity", "checkstyle:NPathComplexity", "checkstyle:MagicNumber"})
    private boolean doIsEncodeable(HttpServletRequest hreq, HttpSession session, String location) {
        // Is this a valid absolute URL?
        URL url;
        try {
            url = new URL(location);
        } catch (MalformedURLException e) {
            return (false);
        }

        // Does this URL match down to (and including) the context path?
        if (!hreq.getScheme().equalsIgnoreCase(url.getProtocol())) {
            return (false);
        }
        if (!hreq.getServerName().equalsIgnoreCase(url.getHost())) {
            return (false);
        }
        int serverPort = hreq.getServerPort();
        if (serverPort == -1) {
            if ("https".equals(hreq.getScheme())) {
                serverPort = 443;
            } else {
                serverPort = 80;
            }
        }
        int urlPort = url.getPort();
        if (urlPort == -1) {
            if ("https".equals(url.getProtocol())) {
                urlPort = 443;
            } else {
                urlPort = 80;
            }
        }
        if (serverPort != urlPort) {
            return (false);
        }

        String contextPath = getRequest().getContextPath();
        if (contextPath != null) {
            String file = url.getFile();
            if ((file == null) || !file.startsWith(contextPath)) {
                return (false);
            }
            String tok = ";" + DEFAULT_SESSION_ID_PARAMETER_NAME + "=" + session.getId();
            if (file.indexOf(tok, contextPath.length()) >= 0) {
                return (false);
            }
        }

        // This URL belongs to our web application, so it is encodeable
        return (true);

    }
Return <code>true</code> if the specified URL should be encoded with
a session identifier.  This will be true if all of the following
conditions are met:
<ul>
<li>The request we are responding to asked for a valid session
<li>The requested session ID was not received via a cookie
<li>The specified URL points back to somewhere within the web
application that is responding to this request
</ul>

@param location Absolute URL to be validated
@return {@code true} if the specified URL should be encoded with a session identifier, {@code false} otherwise.
web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletResponse.java