How to prevent the JSESSIONID showing in the URL

Question

I have created an login page in servlet using Google Datastore, it is working fine. but sometimes its showing the JSESSIONID in the URL.

How can I prevent the JSESSIONID sending through the URL? why its passing through the URL instead of request message?

Solution 1

Add the following entry in your web.xml.

<session-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

This will instruct the container that the client supports cookies and hence there is no need to put the JSessionId in the URL.

Solution 2

Are you using response.encodeURL()? If so, try to remove it or disable "URL Rewriting" and check the URL.

See also:

• disableURLRewriting

Apache Tomcat Configuration Reference

Additional information:

response.encodeURL(URL) adds ;jsessionid=xxxx... to URL. To disable this(="URL Rewriting"),

Tomcat 7.0 or later:

<session-config>
  <tracking-mode>COOKIE</tracking-mode>
</session-config>

Tomcat 6.0:

<Context disableURLRewriting="true" ...

Comments

[Prakash]

No I am not using response.encodeURL(),

[Christopher Schultz]

You should always use response.encodeURL (or response.encodeRedirectURL if appropriate). If you want to disable sessions, use the configuration instead of breaking your application by not following the rules.