java - How to configure Tomcat to not encode the session id into the URL when HttpServletResponse.encodeURL() is invoked

Question

Seems like a stupid question to which the answer would be "Don't use encodeURL()!" but I'm working with a codebase that uses netui anchor tags in the JSPs and I need to disable the writing of JSESSIONID into the URLs as it is a security risk.

In WebLogic, you can configure this by configuring url-rewriting-enabled in weblogic.xml (I know because I wrote that feature in the WebLogic server!). However, I can't find an equivalent config option for Tomcat.

Answer 1

Tomcat 6 supports the disableURLRewriting attribute that can be set to true in your Context element:

http://tomcat.apache.org/tomcat-6.0-doc/config/context.html#Common_Attributes