I want to keep the jsessionid parameter out of the URLs generated by Struts, but can't seem to find a configuration parameter or similar. To be honest, I don't even know exactly at which level this is handled.
Specifically, Struts (or the servlet engine) puts a sessionid in the URL when it's redirecting with a 302 and the session has not been established before (i. e. the redirect is in response to a request that sent no Cookie
header). The response also contains a Set-Cookie
header.
Generally, I just don't want the session id in the URL, ever. No cookies, no session.