如何删除URL（Java）中的jsessionid？

Question

I need help, how can I hide the jsessionid from the url? Use jboss 5.0 and web app version 2.5. In the context on jboss I have

SessionCookie secure = "true"

httpOnly = "true"

Can you help me? " secure " and " httpOnly " must remain set to true

Exmple url : http://localhost:8080/actionMenuGeneral.do;jsessionid=EA9073194BEDF67C16BEE48600B97737

Thank you

Answer 1

Change the following in application's web.xml

<session-config>
    <session-timeout>60</session-timeout>
    <cookie-config>
        <http-only>true</http-only>
        <secure>true</secure>
    </cookie-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

More details at https://access.redhat.com/solutions/338313