What causes the JSessionID changing with every request?

I have a JSF 2, EJB 3.1, CDI Application running on a Glassfish 3.1.2. I have noticed that the jsession id allways changes: with every request I send to to server, the retuned page contains links () with an new jsession id, even if the request already contains a jsession id

I do not think that this is normal, but I have no idea what could cause this behavior.

I have configured:

<session-config>
    <session-properties>
        <property name="enableCookies" value="false" />
        <property name="enableURLRewriting" value="true" />
    </session-properties>
</session-config>

but every thing else is default, I do not have any strange configuration or custom jsession generation stuff. -- Does anybody know what can trigger Glassfish/JSF to change the sessionId?

Example:

The application has a menu that is displayed on every page. The jsf page contains this:

<h:link outcome="/search/search">search</h:link>

Now I describe the requests and responses. The Requests are simple HTTP GET Requests. The Response allways contains the complete page. No Ajax involved.

1. After some Basic Authentication.

2. The user enters the start page, it contains a menu with a link to the search page, and this link has jsession id (all other links have the same jsessionId) - Details;

   • Request: http://localhost:8080/myApp/start/start.xhtml
   • Response content: <a href="/myApp/search/search.xhtml;jsessionid=8df431e2275052cf2348a4cb793e">search</a>

3. The user clicks on that link; the returned page contains the the menu again, but now all links have an other sessionjd - Details:

   • Request http://localhost:8080/myApp/suche/teilnehmer_suche.xhtml;jsessionid=8df431e2275052cf2348a4cb793e
   • Response content: <a href="/myApp/search/search.xhtml;jsessionid=8ebeefb6df144a2fee97d87a51e6">...

4. The user clicks on that link again: the jsession id change again

   • Request http://localhost:8080/myApp/suche/teilnehmer_suche.xhtml;jsessionid=8df431e2275052cf2348a4cb793e
   • Response content: <a href="/myApp/search/search.xhtml;jsessionid=8f4021c2fa628ce3b9c12c545cc4">...

I can click on that link (and every other link) again and again, but the jsession id changed every time.

More strange: after changing the configuration to use cookies instead of urlRewriting I see that this behavior occures even for the resource files:

The client request start.xml without jsession id, the server returns Set-Cookie JSESSIONID=a68d3d9260d7ea5fd36a7713eb80; Path=/myapp; HttpOnly in the response header.

Afterwards the client request the css page with Cookie JSESSIONID=a68d3d9260d7ea5fd36a7713eb80 and the server send back the css file but the response header contains a new session id: Set-Cookie JSESSIONID=a68d550e5093e246b01ba4220cd3; Path=/myapp; HttpOnly