Why is Spring Boot redirecting with jsessionid in the URL even though I already turned it off?

Question

Google Chrome is making this request on the login page.

Request

 Request URL: http://app.country-region-9.elasticbeanstalk.com/admin/login Request Method: POST Status Code: 302 Found Remote Address: 99.99.99.99:80 Referrer Policy: no-referrer-when-downgrade 

Response

 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Connection: keep-alive Content-Language: en-US Content-Length: 0 Date: Thu, 15 Nov 2018 04:23:19 GMT Expires: 0 Location: /home;jsessionid=15884DA40ECAD4F5CBA6CD138B4B4105 Pragma: no-cache Server: nginx/1.12.1 Set-Cookie: JSESSIONID=15884DA40ECAD4F5CBA6CD138B4B4105; Path=/; HttpOnly 

I have this setting already in application.properties .

 server.session.tracking-modes=cookie 

So why is Spring Boot appending ;jsessionid to the redirect location? It is breaking the app because Spring Security complains about the semicolon. It works in my local machine and doesn't append the session. It is only failing when deployed to AWS.

This is the action in the controller which redirects:

$ curl -i http://localhost:8080/admin/login -d username=xxxxx -d password=xxxxxxxxxx
HTTP/1.1 302
Set-Cookie: JSESSIONID=4B8930CCC8CE85167089CEBEB47657D4; Path=/; HttpOnly
...
Location: http://localhost:8080/home

I also confirmed it with curl

 $ curl -i http://app.country-region-9.elasticbeanstalk.com/admin/login -d username=xxxx -d password=xxxxxxxxxxx HTTP/1.1 302 Found ... Location: /home;jsessionid=5A1009B5F3C59ED0F794E625B5E36EA0 

But it's not doing that locally.

 $ curl -i http://localhost:8080/admin/login -d username=xxxxx -d password=xxxxxxxxxx HTTP/1.1 302 Set-Cookie: JSESSIONID=4B8930CCC8CE85167089CEBEB47657D4; Path=/; HttpOnly ... Location: http://localhost:8080/home