How to avoid ;jsessionid=XXX on the first call to a page? it works if first page is jsp
cookies, jboss, jsessionid, jsf, tomcat
Solution
Since Servlet 3.0 you could use `<tracking-mode>COOKIE</tracking-mode>` for this. But as JBoss 4.2.2 isn't Servlet 3.0 compilant, this isn't an option.
Easiest would be to create a servlet filter which sends a redirect to `HttpServletRequest#getRequestURI()` when `HttpSession#isNew()` returns `true`. Don't forget to check the `HttpServletRequest#isRequestedSessionIdFromCookie()` to prevent an infinite redirect loop when the client doesn't support cookies at all.
Problem
I have an application which uses the welcome-page index.jsp with an `<iframe></iframe>` the contents of the iframe is a jsf page. If I access index.jsp I see a cookie already on the first get in firebug: ``` Set-Cookie JSESSIONID=C615DA89B6EF73F801973EA3DCD3B226; Path=/ ``` The page of the `<iframe>` inherits this jsessionid. BUT: when I directly access the page of the `<iframe/>` I get the jsessionId rewritten to all URLs without a cookie - on the first request. Afterwards the cookie is used. This is all fine - if: The security system would allow me to perform url rewrites. I run jboss 4.2.2 I want to achieve the same behaviour as I have with the index.jsp - e.g. always use cookies and always avoid http rewrite. [EDIT] thanks to balusc's answer I wrote this: ``` public class JsessionIdAvoiderFilter implements Filter { public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { boolean allowFilterChain = redirectToAvoidJsessionId((HttpServletRequest) req, (HttpServletResponse)res); //I'm doing this because if I execute the request completely, it will perform a pretty heavy lookup operation. No need to do it twice. if(allowFilterChain) chain.doFilter(req, res); } public static boolean redirectToAvoidJsessionId(HttpServletRequest req, HttpServletResponse res) { HttpSession s = req.getSession(); if(s.isNew()) { //after the redirect we don't want to redirect again. if(!(req.isRequestedSessionIdFromCookie()&&req.isRequestedSessionIdFromURL())) { //yeah we have request parameters actually on that request. String qs = req.getQueryString(); String requestURI = req.getRequestURI(); try { res.sendRedirect(requestURI+"?"+qs); return false; } catch (IOException e) { logger.error("Error sending redirect. " + e.getMessage()); } } } return true; } } ``` Don't forget to add it to your `web.xml` ``` <filter> <display-name>JsessionId Filter</display-name> <filter-name>jsessionIdAvoiderFilter</filter-name> <filter-class>my.namespace.JsessionIdAvoiderFilter</filter-class> </filter> <filter-mapping> <filter-name>jsessionIdAvoiderFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <filter> ```