JSESSIONID

JSESSIONID is a cookie used by Java servlet containers to maintain state for a user session across multiple HTTP requests. The value of the cookie is a server-generated session identifier (HttpSession ID) that the application uses to look up session data stored on the server. The cookie name JSESSIONID is the conventional default used by Java EE and Jakarta EE environments.

The cookie is typically created when a session is started and is sent by the browser with each request to the same web application. Its scope is determined by the cookie's domain and path attributes, which usually restrict it to the host and application context. In most configurations JSESSIONID is a session cookie (no explicit expiration), meaning it is discarded when the browser is closed; it can be configured to be persistent with a Max-Age value.

Security considerations: since the cookie identifies the user's session, it should be protected. Modern servers set the HttpOnly attribute to prevent access from client-side scripts and the Secure attribute to require HTTPS. SameSite can help mitigate cross-site request forgery. If cookies are disabled, servers may fall back to URL rewriting to propagate the session ID, which can expose the ID in URLs.

In clustered deployments, sharing session state across nodes may require session replication, a distributed session store, or sticky sessions at the load balancer. JSESSIONID is container-specific; configuring the server or framework may alter its name or behavior. It is Java-specific and not a cross-language standard.