public Session getSession(SessionKey key) throws SessionException {
        if (!WebUtils.isHttp(key)) {
            String msg = "SessionKey must be an HTTP compatible implementation.";
            throw new IllegalArgumentException(msg);
        }

        HttpServletRequest request = WebUtils.getHttpRequest(key);

        Session session = null;

        HttpSession httpSession = request.getSession(false);
        if (httpSession != null) {
            session = createSession(httpSession, request.getRemoteHost());
        }

        return session;
    }
SessionManager implementation providing {@link Session} implementations that are merely wrappers for the
Servlet container's {@link HttpSession}.
<p/>
Despite its name, this implementation <em>does not</em> itself manage Sessions since the Servlet container
provides the actual management support.  This class mainly exists to 'impersonate' a regular Shiro
{@code SessionManager} so it can be pluggable into a normal Shiro configuration in a pure web application.
<p/>
Note that because this implementation relies on the {@link HttpSession HttpSession}, it is only functional in a
servlet container - it is not capable of supporting Sessions for any clients other than those using the HTTP
protocol.
<p/>
Therefore, if you need {@code Session} support for heterogeneous clients (e.g. web browsers,
RMI clients, etc.), use the {@link DefaultWebSessionManager DefaultWebSessionManager}
instead.  The {@code DefaultWebSessionManager} supports both traditional web-based access as well as non web-based
clients.

@see DefaultWebSessionManager
@since 0.9
web/src/main/java/org/apache/shiro/web/session/mgt/ServletContainerSessionManager.java