title: How to avoid ;jsessionid=XXX on the first call to a page? it works if first page is jsp
body: <p>I have an application which uses the welcome-page index.jsp with an <code>&lt;iframe&gt;&lt;/iframe&gt;</code> the contents of the iframe is a jsf page. If I access index.jsp I see a cookie already on the first get in firebug:</p>
  
  <pre><code>Set-Cookie  JSESSIONID=C615DA89B6EF73F801973EA3DCD3B226; Path=/
  </code></pre>
  
  <p>The page of the <code>&lt;iframe&gt;</code> inherits this jsessionid. BUT: when I directly access the page of the <code>&lt;iframe/&gt;</code> I get the jsessionId rewritten to all URLs without a cookie - on the first request. Afterwards the cookie is used. This is all fine - if:
  The security system would allow me to perform url rewrites. </p>
  
  <p>I run jboss 4.2.2 </p>
  
  <p>I want to achieve the same behaviour as I have with the index.jsp - e.g. always use cookies and always avoid http rewrite.</p>
  
  <p>[EDIT]
  <strong>thanks to balusc's answer I wrote this:</strong></p>
  
  <pre><code>public class JsessionIdAvoiderFilter implements Filter {
  
              public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException,
                      ServletException {
                  boolean allowFilterChain = redirectToAvoidJsessionId((HttpServletRequest) req, (HttpServletResponse)res);
  
                           //I'm doing this because if I execute the request completely, it will perform a pretty heavy lookup operation. No need to do it twice.
                  if(allowFilterChain)
                      chain.doFilter(req, res);
              }
  
  
              public static boolean redirectToAvoidJsessionId(HttpServletRequest req, HttpServletResponse res) {
                  HttpSession s = req.getSession();
                  if(s.isNew()) {
  
   //after the redirect we don't want to redirect again.
  if(!(req.isRequestedSessionIdFromCookie()&amp;&amp;req.isRequestedSessionIdFromURL()))
                      {
                                  //yeah we have request parameters actually on that request.         
                          String qs = req.getQueryString();
  
                          String requestURI = req.getRequestURI();
                          try {
                              res.sendRedirect(requestURI+"?"+qs);
                              return false;
                          } catch (IOException e) {
                              logger.error("Error sending redirect. " + e.getMessage());
                          }
                      }
                  }
                  return true;
              }
  }
  </code></pre>
  
  <p>Don't forget to add it to your <code>web.xml</code></p>
  
  <pre><code>    &lt;filter&gt; 
      &lt;display-name&gt;JsessionId Filter&lt;/display-name&gt; 
      &lt;filter-name&gt;jsessionIdAvoiderFilter&lt;/filter-name&gt; 
      &lt;filter-class&gt;my.namespace.JsessionIdAvoiderFilter&lt;/filter-class&gt; 
  &lt;/filter&gt; 
  &lt;filter-mapping&gt; 
      &lt;filter-name&gt;jsessionIdAvoiderFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  &lt;filter&gt; 
  </code></pre>