getSession() always creates a new session

问题

We have SecurityFilter class in our application by implementing Filter and our doFilter method looks like this.

public void doFilter(ServletRequest sres, ServletResponse sreq,
            FilterChain chain) throws IOException, ServletException {

        LOGGER.debug(Logger.buildLogMessage("Starting SecurityFilter.doFilter"));
        HttpServletRequest request = (HttpServletRequest) sres;
        HttpServletResponse response = (HttpServletResponse) sreq;

        HttpSession session = request.getSession();

We have the following entry in our web.xml

<filter>
        <filter-name>SecurityFilter</filter-name>
        <filter-class>com.a.b.c.web.filter.SecurityFilter</filter-class>
</filter>

<filter-mapping>
        <filter-name>SecurityFilter</filter-name>
        <url-pattern>/resources/*</url-pattern>
</filter-mapping>

We have many REST calls to our application and all of them pass through this filter. The Java API documentation says, the request.getSession() returns a session if exists else it creates a new session. But in our application the request.getSession() always creates a new session for every REST call. What could be going wrong here ?

回答1:

If your application settings are set to track JSESSIONID via cookie, the application will return the same session if you're making a request from the same browser, and a new session if you're making a request from a different browser. This is obviously because cookies live on a per-browser basis.

来源：https://stackoverflow.com/questions/23007445/getsession-always-creates-a-new-session