Is it possible to disable jsessionid in tomcat servlet?

You can disable for just search engines using this filter, but I'd advise using it for all responses as it's worse than just search engine unfriendly. It exposes the session ID which can be used for certain security exploits (more info).

Tomcat 6 (pre 6.0.30)

You can use the tuckey rewrite filter.

Example config for Tuckey filter:

<outbound-rule encodefirst="true">
  <name>Strip URL Session ID's</name>
  <from>^(.*?)(?:\;jsessionid=[^\?#]*)?(\?[^#]*)?(#.*)?$</from>
  <to>$1$2$3</to>
</outbound-rule>

Tomcat 6 (6.0.30 and onwards)

You can use disableURLRewriting in the context configuration to disable this behaviour.

Tomcat 7 and Tomcat 8

From Tomcat 7 onwards you can add the following in the session config.

<session-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

Use a Filter on all URLs that wraps the response in a HttpServletResponseWrapper that simply returns the URL unchanged from encodeRedirectUrl, encodeRedirectURL, encodeUrl and encodeURL.

Also if you have Apache in front of Tomcat you can strip out the jsession with a mod_rewrite filter.

Add the following to your apache config.

#Fix up tomcat jsession appending rule issue
RewriteRule  ^/(.*);jsessionid=(.*) /$1 [R=301,L]

This will do a 301 redirect to a page without the jsessionid. Obviously this will completely disable url jsessionid's but this is what I needed.

Cheers, Mark

in tomcat 7 and above, you can add this in tomcat/conf/context.xml

<Context cookies="false">

to disable JSESSIONID. More on this help doc (refer cookies section).