Where is JSESSIONID stored? (JavaEE)

Question

I have two applications - A Java EE web application and a Java SE applet. I want to authenticate a user in the applet by means of a JSESSIONID (which is created by the web a

Answer 1

JSESSIONID is a low-level mechanism that you typically shouldn't care about. On the server side the servlet container transparently translates JSESSIONID to an HttpSession object available in the servlet. The session id is passed to the server transparently as well using Cookie header or URL rewriting.

So if you are clicking on a link or posting an ordinary form in a webpage, the browser automatically passes JSESSIONID cookie or attaches it to URL.

Your design has a major flaw: secure servlet containers should add HttpOnly attribute to JSESSIONID cookie (see: How do you configure HttpOnly cookies in tomcat / java webapps?) This is to prevent JavaScript from reading JSESSIONID cookie for security reasons - like hijacking user session. Your applet might not even see that cookie!

I don't know much about applets, but I would advice you to perform HTTP request via web browser somehow so the security identification (cookie) is handled automatically.