Using Spring Security Without Cookies

Question

I need to implement session management in a Spring app for a mobile browser that doesn't support cookies. Can this be done by putting the session id in the querystring of a GET request? How do you manage this with Spring? Is there a built-in option I'm missing? Should I write my own auth filter? Are there special security issues to consider with this approach?

We're running Spring 2.0.6, so I'd be using Spring Security 2.

Answer 1

try using <http disable-url-rewriting="false">. This will append session id to the URL.