[Jetty-support] Sessions without cookies

[Silvio B. <sbi...@ja...>]

Hello all,

I am using Jetty 6.1.5 on Debian. I have a problem with session 
tracking. In some cases users have disabled cookies altogether. To allow 
this I have built in a redirect on the first request just after the 
creation of a new session. I redirect to the same URL with a 
JSESSIONID=<session.getId()> addition.

If I hit this with cookies enabled the redirect occurs but the session 
is tracked normally via the cookie. Manually removing the JSESSIONID 
parameter from the URL does not disturb the session. This is what I 
expected.

But when I hit it with cookies disabled the following happens:
-a new session with id=S1 is created
-the redirect points the browser to ...?JSESSIONID=S1
-when the resulting requests comes in the session is not recognized but 
a new one with id=S2 is created
-the redirect points the browser to ..?JSESSIONID=S2
-and round and round we go...


What am I missing here? Will Jetty not recognize a session based on a 
URL parameter named JSESSIONID? I also tried jsessionid in lowercase but 
the behaviour stays the same. Can someone tell me what I am doing wrong?

Kind regards,

Silvio Bierman