How Tomcat handles session internally?

Question

From my understanding, Servlet Containers handle session using some HTTP protocols like, - Hidden Form Fields - URL Rewriting - Cookies I'm curious how Apache Tomcat handles the session internally, though it's irrelevant to average developers. Is Tomcat using cookies or others also?

Accepted Answer

By default, Tomcat directly sends cookies in the HTTP response , like `SET COOKIE:JSESSIONID....` back to the browser and rewrites the URL to add a `JSESSIONID` parameter in it , for the first request, so that it can fall back on the later in case cookies are disabled in the client browser. The next time if the browser requests the server with the `JSESSIONID` in its `request` , Tomcat will use the `JSESSIONID` cookie for maintaining the session. You can overide the session cookie behavior in Tomcat by modifying context.xml: ``` ``` and disable the url re-writing the same way : ``` ``` Even read this Servlet Session Tracking with cookies (JSESSIONID)

How Tomcat handles session internally?

Solution

Problem