How to prevent the JSESSIONID showing in the URL [duplicate]

Answer 1

Add the following entry in your web.xml.

<session-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

This will instruct the container that the client supports cookies and hence there is no need to put the JSessionId in the URL.

Answer 2

Are you using response.encodeURL()? If so, try to remove it or disable "URL Rewriting" and check the URL.

See also:

• disableURLRewriting

Apache Tomcat Configuration Reference

Additional information:

response.encodeURL(URL) adds ;jsessionid=xxxx... to URL. To disable this(="URL Rewriting"),

Tomcat 7.0 or later:

<session-config>
  <tracking-mode>COOKIE</tracking-mode>
</session-config>

Tomcat 6.0:

<Context disableURLRewriting="true" ...