title: How can I prevent spring-security from appending ;jsessionid=XXX to login redirects?
body: <p>When an unauthenticated client requests a URL that requires a non-anonymous access level as defined in <code>security-config.xml</code>, spring security sends an HTTP redirect to our login page (e.g. <code>/login</code>).  That's fine.</p>
  
  <p>The issue is that absent an existing session (identified by a cookie provided in the client's request), spring-security issues a redirect that also specifies the client's new session in the URL, e.g. <code>/login;jsessionid=8o7pglapojus</code>.</p>
  
  <p>Many containers support this (apparently it works fine in tomcat?), but it appears that Jetty (which is what we're using right now) does not -- the redirected URL comes through to our URL router completely intact (including the <code>jsessionid</code> "parameter"), and the named session is not associated with the <code>/login</code> request by jetty/spring-security (i.e. a totally new session ID is provided in the Set-Cookie header of the response to the <code>/login</code> request).</p>
  
  <p>We can work around this by matching <code>/login.*</code> in our routes, but I'm curious if there's any way to prevent the emission of the session id in the authentication redirect to begin with.</p>