The userid set in session resides only in the server. The client will not have access to it. The client will have access only to the jsessionid cookie. And servers generate random values for jsessionid. So your approach looks fine. But if you are accepting the userid from the http request, then it will be a problem.
Joined: Aug 13, 2003
But i did not get what you mean by posting userid thourgh http request?