How is a sessionID generated?
jakarta-ee, java, servlets, tomcat
Solution
It is container specific. Tomcat: http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html#Manager
Problem
When running a java web application with the servlet api (like JSF or JSP pages), somewhere along the line a 'unique' SessionID is generated to identify the user's session. I'm wondering how these sessionID's are generated. Do they include the IP of the client? A timestamp? Random numbers? Secondly, I'm wondering where this generation happens? Is this dependent on the server that runs the application?