// retrieve webSSLSession instance. if request is new request, as indicated by
// the request parameter 'mashssl.request.id', a new session is returned ready
// for authentication. otherwise an existing session is returned

WebSSLSession webSSLSession = webSSLSessionManager.getSession(request, response);

// if the authentication status is null, then a new session was returned in the
// previous step. invoke the mashssl handshake. note the no additional processing
// can be performed following invocation - hence the return statement

AuthenticationStatus authenticationStatus = webSSLSession.getAuthenticationStatus();
if (authenticationStatus == null) {
    logInitialMessage(request, webSSLSession);
    webSSLSession.authenticate();
    return;
}

// if authentication status is not null, the mashssl handshake is complete. check
// to see if the partner was authenticated. if not, we return a 401 error. if,
// yes, we return content in response to the original request

if (authenticationStatus.isAuthenticated()) {
    response.setContentType("text/plain; charset=UTF-8");
    response.setStatus(HttpServletResponse.SC_OK);
    response.setHeader("Access-Control-Allow-Origin", "*");
    String responseContent = getResponseContent();
    response.getOutputStream().write(responseContent.getBytes("UTF-8"));
    webSSLSessionManager.destroySession(webSSLSession);
} else {
    response.sendError(401, "MashSSL authentication failed.");
}