How to get the session's contents when cookie was disabled

Question

On the condition that the ie's cookie is disabled! But I also want to submit the jsessionid by the following syntax:

<input type="hidden" name="jsessionid" value="xxxxxxxxxx"/>

The result is there is a new Session was created on the server instead of the old Session which i want to keep. Is there anybody who can tell me the reason? And I also don't want to use the Url rewrite to resolve the Session content trans. 'Cause it seems to be some security problems.

PS:My test environment is Tomcat5.5 and Jdk1.5

Best regards! Thanks!

Answer 1

You could just create a bunch of hidden fields to go with the jsessionid. They could contain all your session data. If you have a large amount of data, then passing it back and forth might be a drag on your web app.
Alternatively, you could create an application-scoped Map. The keys in that Map could be the jsessonids and the values could be the HttpSession objects. A HttpSessionListener could add and subtract entries. That way you would only need to pass the jsessionid back and forth. Your JSPs will have to use <%@ page session="false" %> and you would create a session only if the hidden field for jsessionid is not sent in the request for the page.