Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

jsessionid is occurred in all urls which are generated by jstl <c:url..> tag

I've got some strange bug: when I open page first time in some browser all references has jsessionid parameter (like <a href="/articles?name=art&jsessionid=5as45df4as5df"..>).

When I press F5 or refresh the page by any other ways all that stuff is disappeared and everything works fine until I close my browser (and all tabs should be closed too). When I open it again I see this strange jsessionid parameter.

I use jstl <c:url..> tag for creating all URLs.

I've read some time ago that jsessionid is an alternative to cookies if cookies are disabled, but cookies are enabled and I actually don't use cookies.

like image 574
Roman Avatar asked Jun 25 '09 19:06

Roman


People also ask

How do I stop Jsessionid in URL?

Set sessionManager. sessionIdUrlRewritingEnabled = false to disable appending JSESSIONID to the URL. NOTE: if a user has disabled cookies, they will NOT be able to login if this is disable.

Why does URL show Jsessionid?

The JSESSIONID is used to ensure that loadbalancers properly route communications to and from the correct client/server partners. By default, Oracle Forms requests a JSESSIONID be generated and maintained in the URL of each exchange between the client and server.

How is Jsessionid generated?

JSESSIONID is a cookie generated by Servlet containers and used for session management in J2EE web applications for HTTP protocol. If a Web server is using a cookie for session management, it creates and sends JSESSIONID cookie to the client and then the client sends it back to the server in subsequent HTTP requests.


1 Answers

This isn't a bug, it's by design. When a new session is created, the server isn't sure if the client supports cookies or not, and so it generates a cookie as well as the jsessionid on the URL. When the client comes back the second time, and presents the cookie, the server knows the jsessionid isn't necessary, and drops it for the rest of the session. If the client comes back with no cookie, then the server needs to continue to use jsessionid rewriting.

You may not explicitly use cookies, but you do implicitly have a session, and the container needs to track that session.

like image 135
skaffman Avatar answered Oct 03 '22 12:10

skaffman