CODEWITHSUNDEEP
servletsjakarta-eejetty
user1424739
user1424739

Reputation: 13685

Are request JSESSIONID and response JSESSIONID supposed to be different?

I see that JSESSIONID in the request header and the response header of an HTTP request is different. Is it a common scenario or an exception?

Upvotes: 2

Views: 692

Answers (1)

Joakim Erdfelt
Joakim Erdfelt

Reputation: 49462

This is normal, but I wouldn't say common. It depends on what you are doing during that request / response exchange.

Invalidating any existing Session on login / logout is a common technique.

Using Session invalidate to invalidate an existing session is common.

Using HttpServletRequest.changeSessionId() during a change in login is also common, and a recommended technique by the security experts out there too.

But none of those happen on all requests, and shouldn't be the norm for the majority of your request.

In short, it's normal / common for certain types of requests (credential change, login, authentication, authorization, etc), but rare to unheard of for other types of requests.

Upvotes: 3

Related Questions