How is JSESSIONID passed? As a header parameter or as a cookie parameter?

Admin 1
Viewed 5564

After a user is Authenticated, subsequent requests from the user need not be authenticated again. This is achieved using JSESSIONID.
But what I am not sure is, how is JSESSIONID passed? As a header field or as a cookie field. Or it is up to the application developer who can choose one or the other approach.

Can some one explain how this works when spring-security is used for authentication and authorization.

spring-security session authentication jsp java
3 Answers

JSESSIONID is a cookie defined by J2EE standard which is passed along with other cookies in the Cookie HTTP Header, whose value follows the format [cookie1]=[value1]; [cookie2]=[value2]; ...

Example:

Cookie: userLocale=en; userTimezone=Europe/Berlin; JSESSIONID=DCFE1E7FB2C6BFFDD5153B7C79B9CEED; _ga=GA1.1.1774863087.1561033937
user_26397720

It will be send as

Cookie:JSESSIONID=SOMETHING; customCookie=SOMEOTHERTHIG

In header

user_120566150
Related