Comments on: Java’s SEO blunder: jsessionid

By: Todd Huss

Todd Huss — Mon, 04 Dec 2006 06:04:06 +0000

Bryce, I like the solution, it’s easy to implement and will work with servlet containers like Tomcat that (unlike Resin) don’t give you the option to disable JSESSIONID!

By: Bryce Nesbitt

Bryce Nesbitt — Sun, 03 Dec 2006 08:36:40 +0000

This offers a geek-heavy way to solve this problem, by creating a “filter”. It’s a long way from simple. but should work: http://randomcoder.com/articles/jsessionid-considered-harmful

By: Ryan

Ryan — Tue, 19 Sep 2006 18:38:44 +0000

Hey, I have the same request as Matt–any chance of getting you to publish your version of c:url?

thanks,
r

By: Matt Davis

Matt Davis — Tue, 12 Sep 2006 20:33:34 +0000

Great article about the jsessionid! I had stumbled on to this article trying to prep my site for launch. I have several c:url tags in my application on my home page. When the browser is first started the links all include the jsessionid, however once I’ve refreshed the page the jsessionids are removed. You mentioned that you had rewritten the c:url tag to disable setting the jsessionid. I know it may be asking too much, but would you be willing to share some of the code ? Thanks!

By: Todd Huss

Todd Huss — Thu, 06 Apr 2006 18:11:25 +0000

Rb, great point, the search engines may be at fault! However, when a good part of your revenue relies on search engine traffic, “their fault” becomes your problem.

By: rb

rb — Thu, 06 Apr 2006 06:46:16 +0000

I may be confused regarding the problem here, but aren’t the search engines at fault? I thought that what is behind the ; is a path parameter and does not map to the underlying resource - I could be wrong, the wording in the rfc is not very clear to me.

By: Todd Huss

Todd Huss — Wed, 05 Apr 2006 23:14:52 +0000

Hi Frank, I was never able to find any way in Tomcat to disable session rewriting. This somewhat dated post sums up the problem:

http://marc.theaimsgroup.com/?l=tomcat-user&m=108684966627534&w=2

If the situation has changed and someone knows about it please let me know!

By: Frank

Frank — Wed, 05 Apr 2006 21:39:11 +0000

Well, I’m not a servlet Guru, but Resin has a switch in webapp configuration to switch session on/off and to enable cookies and or urls for this. I cannot believe any other servlet container is not having an equivalent.

Personally I still prefer session ids over cookies, call me oldfashioned.