JBoss 7 appends JSESSIONID to URL despite tracking-mode cookie

Question

Yes, this is another "JSESSIONID in URL" question, but I haven't been able to find an answer. I'm running JBoss AS 7.1.1 Final and this is my web.xml:

<web-app version="3.0"
  xmlns="http://java.sun.com/xml/ns/javaee"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="
    http://java.sun.com/xml/ns/javaee
    http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">

    <session-config>
        <cookie-config>
            <!-- Prevents session cookie from being read by clientside scripts -->
            <http-only>true</http-only>
            <!-- Prevents the session cookie from being transmitted on HTTP -->
            <!-- secure>true</secure-->
        </cookie-config>
        <tracking-mode>COOKIE</tracking-mode>
        <session-timeout>30</session-timeout>
    </session-config>

    <servlet>
        <servlet-name>appServlet</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>com.cgi.dk.vias.web.config.WebConfig</param-value>
        </init-param>
        <init-param>
        <param-name>contextClass</param-name>
        <param-value>
            org.springframework.web.context.support.AnnotationConfigWebApplicationContext
        </param-value>
    </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>appServlet</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>
</web-app>

Based on internet search and answers here on Stack Overflow (e.g. https://stackoverflow.com/a/11350819/224143), it is my understanding that setting <tracking-mode>COOKIE</tracking-mode> should prevent JSESSIONID from being appended to URLs. However, when I browse to my site with a fresh browser window (i.e. no existing cookies or session), all links have JSESSIONID appended in the first response. If i refresh the page, the JSESSIONID disappears, since it goes into the cookie.

I understand that I can create a filter to remove it, but I'd rather avoid tampering with the html if possible.

My browser supports cookies, of course, and they are enabled.

Is my understanding of the <tracking-mode> element wrong, or is there something else going on that I'm missing?

Answer 1

If you are using spring security, then you should try setting disable-url-rewriting attribute of <http> element to true.

Regards,