how can i do sessions in java if some one disables cookies in my browser?

Question

I like to know if someone disables the cookies in my browser then cookies dont work for my browser then how can I do sessions in java. I am writing servlets for server side

Answer 1

See HttpServletResponse encodeURL() and encodeRedirectURL().

These functions will rewrite your URLs appropriately to include the session information if the browser doesn't support cookies. Depending on what Java web framework you're using, these functions may be called automatically (as long as you use the framework's methods for writing URLs).

Note that this may not be desirable in all cases, due to the security and caching implications of making the session ID visible in the links. This page summarizes the issues much better than I can in this short space, and provides a way to disable this feature.

Answer 2

You need to append the jsessionid to all the URL's involved in your webapplication which are supposed to be invoked by the client. This includes the redirect URL's and the links in the JSP page.

In case of a redirect URL, you need to use HttpServletResponse#encodeRedirectURL() first:

response.sendRedirect(response.encodeRedirectURL("page.jsp"));

In case of links in a JSP page, you basically need to pass those URL's through HttpServletResponse#encodeURL() first. You can do this with help of JSTL's (just drop jstl-1.2.jar in /WEB-INF) <c:url> tag, it will behind the scenes pass the URL through the aforementioned method:

<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
...
    <a href="<c:url value="page1.jsp" />">link1</a>
    <a href="<c:url value="page2.jsp" />">link2</a>
    ...
    <form action="<c:url value="servlet" />" method="post">
        ...
    </form>